17 Dec 2021

Scammers Are Getting Better; So Must We

If you're hoping that 2022 will be the year that spammers and scammers are all finally captured and dragged off to prison, I hate to disappoint. But it's not going to happen. Many of the scams are getting better, which makes them more difficult to spot, and that makes it even more important to treat every email, every instant message, and every phone call as a potential fraud.

 Click any small image for a full-size view. To dismiss the larger image, press ESC or tap outside the image.

The greatest increase I've seen is in scams delivered by phone. Fortunately, Google Fi includes a robust screening service that knows about many robocall numbers and can automatically block them. I have enabled this feature. When someone in my list of contacts calls, the phone rings; but if the call is from an unknown or blocked number, Google Fi asks the the caller about the purpose of the call. If there's no response, the call is silently dropped. If the caller responds, I see a transcript and and choose whether to answer the call. As a result, I haven't spoken to a scammer in well more than a year.

Email scams are still the most dangerous because a single mistaken click can result in the installation of malware on a poorly protected computer and sometimes even on a computer that has a current antimalware application running. The final line of defense always has to be the user.

User caution is often the only defense against advanced persistent threats (APT) that can be delivered to the computer in seeming harmless pieces that are activated only when all of the parts are present.

Kaspersky Labs says that APTs will become even more serious in 2022.

The term advanced is used because the criminals behind the scams often have access to a lot of information about the intended victim and are skilled application developers. Individual components of an advanced persistent threat may seem unsophisticated, but when combined they can create a powerful threat. Persistent means that the attackers have specific objectives in mind and take a slow, cautious approach to avoid detection. This frequently means that they forego easy targets so that they can maintain long-term access to a compromised system. Threat is obvious in that APT attacks have capability and intent. The criminals behind them are usually well funded and may be sponsored by a nation.

Advanced persistent threats are more commonly aimed at business and government targets, but not exclusively at these targets. So it's worthwhile even for home and small business users to be aware of the threats because components of these attack vectors can be used against smaller targets. Here are some of Kaspersky Lab's key predictions for 2022:

• Mobile Devices Will Be Targets: Mobile devices are ideal targets for criminals because their owners carry them everywhere. Malware on mobile devices is more difficult to prevent and detect. Apple's IOS cripples protective apps and Kaspersky says this "creates an extraordinary opportunity for APTs, one that no state-sponsored adversary will want to miss." The report says that Android devices are plagued by a lot of cybercriminal malware, but IOS is the primary target for advanced nation-state sponsored cyberespionage.
• Low-Level Bootkits Will Return: These are problematic for criminals because they can cause the target device to fail, but they are nearly impossible to detect if they are installed properly. Kaspersky says it may be that the stealth gains now outweigh the risks, or that low-level development has become more accessible. To some extent, Windows 11 with its secure boot technology will make life harder for cybercriminals.
  You may think that "bootkit" was a typo. It wasn't. A bootkit is an advanced form of rootkit that targets the master boot record on the computer's motherboard. Bootkits are often installed via bootable media. However, the malware can also be distributed via seemingly harmless software applications, phishing emails, or free downloads.
• Work From Home Will Be A Larger Target: Attacks aimed at people who work from home increased a lot in 2021 and that trend will continue in 2022. Attacks against workers who are outside the office can give criminals access to a company's internal network. Social engineering can be used to obtain credentials and brute-force attacks can be staged on remote computers. The criminals seek poorly protected computers and servers, particularly if the company allows remote workers to use their own computers instead of providing hardened corporate hardware. Kaspersky says attackers will look for new opportunities to exploit home computers that are unprotected or unpatched, as an entry vector to corporate networks.
• Supply Chains Are Powerful Assets For Criminals: Supply-chain attacks are the gold standard for criminals. Because supply-chain providers often have computers that are connected to their customers' computers, introducing malware onto a vendor's computer can provide access to dozens or hundreds of other computer systems. Earlier this year, the attack that shut down Colonial Pipeline for several days was the result of a supply-chain attack. Expect to see more attack like this in 2022.

The full report is on the Kaspersky Securelist website.

If your credentials are compromised, it's good that banks have improved their ability to detect potentially fraudulent transactions. Sometimes they get it wrong, though. Banks have also improved their notification processes so that they are less bothersome. I purchased several gift cards in late November for family members. Dewey's Pizza, Kroger, and Penzey's Spices are all popular with the family. My attempt to buy a Kroger gift certificate was declined, but my phone immediatly pinged me with a question from the bank.

After confirming that I was the person who wanted to purchase the gift card, the bank's automated process told me to try the transaction again. I did and it was successful.

Any computer that is connected to a network, and particularly any computer that is connected to the internet is vulnerable. No matter how many protective devices and applications stand between the internet and your computer, some malware can get through. That's because antimalware applications have to know about a threat before they can protect against it.

Caution and skepticism are the key components of a complete protective system. The US Department of Defense published Best Practices for Keeping Your Home Network Secure in 2014. In computer years, that's generations ago, but the basic information in this seven-year-old document is still valid. It includes recommendations such as keeping the operating system and applications up to date, limiting the use of administrator accounts, using a web browser with "sandboxing" capabilities, encrypting data, using a firewall, and forcing all users to log on to your Wi-Fi network.

It's a seven-page document, so it's not something you'll read in one or two minutes, but reading it would be the fine way to use half an hour if you value your data, your identity, your security, and your money.

The report can be downloaded from the Department of Defense website.

Short Circuits

Teaching Your Newborn To Be Bilingual

One fact: Research suggests strongly that newborns possess the ability to learn any human language. That is, they will develop the ability to understand and create the unique sounds used by various languages. During their first few years, languages other than those spoken at home fall away. Another fact: Research has also shown convincingly that the brain of a bilingual person has better attention and task-switching capacities than the brain of a monolingual person.

So should everyone speak more than one language? Clearly there are advantages. A relative by marriage was born in Europe and spoke several languages natively. She was, for several years, a translator at the United Nations. Many of the countries in Europe are the size of some states or provinces in the United States and Canada. Some countries recognize several languages as the "official" language. Consider Switzerland: The most common language is a Swiss variant of German, and it varies so much from German that Germans have trouble understanding it. But the Swiss are also taught standard German in school. They also speak a Swiss variant of French and a Swiss variant of Italian. So that's four primary languages. But English is widely spoken, too. The Swiss switch comfortably between languages.

English is nearly the exclusive language in most of the United States and Canada. Canada is technically bilingual, but French is widespread only in Quebec. Spanish is spoken commonly in southwestern parts of the United States. Unfortunately, many immigrants insist that their children speak only English, which eliminates the advantages they could gain by retaining at least one additional language.

According to the Dana Foundation, "Research has overwhelmingly shown that when a bilingual person uses one language, the other is active at the same time. When a person hears a word, he or she doesn't hear the entire word all at once: the sounds arrive in sequential order. Long before the word is finished, the brain’s language system begins to guess what that word might be by activating lots of words that match the signal. If you hear 'can', you will likely activate words like 'candy' and 'candle' as well, at least during the earlier stages of word recognition. For bilingual people, this activation is not limited to a single language; auditory input activates corresponding words regardless of the language to which they belong."

The research shows that maintaining balance between two languages causes a bilingual person's brain to strengthen executive functions, a regulatory system of general cognitive abilities that includes processes such as attention and inhibition. "Because both of a bilingual person’s language systems are always active and competing," the Dana Foundation report says, "that person uses these control mechanisms every time she or he speaks or listens. This constant practice strengthens the control mechanisms and changes the associated brain regions."

If you're like most Americans, you speak only English. Maybe you remember a bit of Latin or French from high school, some German or Russian from college, but how can you leverage that to help your newborn retain and build on the multilingual ability we all arrive with? Even when I was learning Russian at Ohio State University, I couldn't speak, read, or write well enough for the skills to be any use to my daughters. I could accuse them of stealing my pencil, ask them why, and tell them I was very offended — but that's about it. I never came close to speaking Russian natively.

Ты украл мой карандаш! Почему? Я очень обижен. How useful is that if you want to encourage bilingualism? To say nothing of my timing, phrasing, and inflection.

 Click any small image for a full-size view. To dismiss the larger image, press ESC or tap outside the image.

A startup company in Cleveland hopes to change that. SmallTalk is developing technology licensed from the Baby Brain Optimization Project Research Lab of Nationwide Children’s Hospital, in Columbus. Their first product is the SmallTalk Egg, which is still in beta and the first eggs will be shipped in January 2022. The devices are intended for use with babies between 0 and 9 months. The egg allows babies to  interact with what they’re hearing, not just listen to recorded information in a foreign language.

According to SmallTalk chief science officer, Nathalie Maitre, a physician scientist who specializes in infant brain development, "content is recorded in 'infant-directed speech' or what is more commonly known as baby talk — that rhythmic, sing-songy tone adults naturally use to speak with babies. This speech pattern keeps baby’s attention and gives them the important language data their brains need.

If you'd like to know more, visit the SmallTalk website.

Mostly Cloudy With A Chance Of Collaboration

The term "cloud first" is showing up more frequently when companies describe their products. Adobe, for example, talks about design teams doing their initial work in Photoshop and Illustrator in cloud-based applications and moving projects to individual workstations later.

 Click any small image for a full-size view. To dismiss the larger image, press ESC or tap outside the image.

Microsoft has emphasized the ability to collaborate with other workers by concurrently working on Microsoft 365 documents (formerly Microsoft Office 365 and before that just Microsoft Office). The Covid pandemic accelerated the trend and, as 2021 is ending, I've been wondering where collaboration will go in 2022.

Collaboration was one of the main topics at this year's Adobe Max conference. The conference itself was fully online and virtual, which served to emphasize the point. Next year's Max conference may return to being an in-person event, but I hope that more than just the keynote presentations are retained as online events.

Online collaboration allows participants, wherever they are, to comment on and even modify a document that is being presented for review. It powerful, even more powerful that gathering designers and stakeholders in a single room with everyone looking over the shoulder of the designer. Any participant can be given permission to add notes to the document with suggestions for change and even to make changes that can be incorporated into the work, but that still leave the original work untouched.

I've worked with distant clients since the mid 1990s. One client lived in Arizona, but traveled internationally for speaking engagements and to meet with his clients. There was no cloud-based collaboration in the 1990s, but there was email. When he was on the west coast, I could send documents, layouts, and recommendations at the end of my day. He would then respond by the end of his day and I'd have his feedback in the morning.

At the time that seemed amazing because it seemed faster and more responsive than working with clients and suppliers in town. Preparing a newsletter for print, a simple project by today's standards, took at least a week even after all of the photos had been taken and all of the articles had been written. Today, that kind of project can be finished in an afternoon, with time left over for a Zoom session or two, an online training class, and afternoon tea.

By 2020, online collaboration had come a long way, and it helped keep a lot of businesses on track when people couldn't work in their offices. Nearly two years later, a lot of people don't want to work five days a week in their offices. Working from home has become the new normal for some, and think tanks have reports that suggest five-day work weeks waste time, effort, and resources.

Maybe four-day work weeks would be more efficient. Or three-day work weeks. Office workers waste a lot of time. That's not surprising and it's not new. Good managers have known for at least a couple of decades that it's better to let good workers set their own schedules. If someone can complete all of their work in 24 hours, why should they spend 40 hours in the office?

If you think this isn't the case, consider a situation you may have encountered: It's Thursday afternoon and you're taking vacation days all next week. You suddenly receive a project that would normally take 16 hours to complete, but you have only three hours today and eight hours on Friday. Besides, you'd like to leave an hour early to beat the rush-hour traffic. Will you finish the project by Friday afternoon? Yeah, you probably will.

So times are changing. We're finding ways to be more efficient.

Research company Gartner says more than 85% of organizations will use a cloud-first strategy by 2025. Gartner vice president Milind Govekar says the cloud is where things will happen in the near future. "The adoption and interest in public cloud continues unabated as organizations pursue a 'cloud first' policy for onboarding new workloads," he says. We've already seen this as banks have invested in mobile payment systems, energy companies use the cloud to improve their customers' retail experiences, and car companies launch personalization services for drivers' safety and infotainment.

Note, though that "safety" and "infotainment" may be seen as mutually exclusive. The motorist who is engaged with onboard "infotainment" can easily miss the fact that a traffic signal has turned red or that congested traffic has come to a standstill. The result is a collision that may injure or kill other motorists.

As an aside: Traffic "accident" is often a misnomer. Many collisions could be avoided if only one or more of the participants had been paying attention. But we're getting a bit off track here.

Gartner estimates that more than 95% of new digital workloads will be deployed on cloud-native platforms by 2025. That's a massive increase, up from 30% in 2021. Beyond that, Gartner says 70% of new applications developed by organizations will use low-code or no-code technologies by 2025. That's more than double what was the norm in 2020. The rise of low-code application platforms drives an increase in "citizen development". Adobe makes it possible for people with few photo editing skills to perform professional-level edits. Expanded to the larger set of computer users, this means that applications will be created by people who are not IT specialists.

There's a clear danger here. In the early days of desktop typesetting, which was called "desktop publishing" in those days, there was a term for documents created by people who had no design or typesetting experience: RANSOM NOTE PUBLISHING. This could be more hazardous when software can be created by anyone. It's concerning that people who have the equivalent of no experience flying even a Cessna Skyhawk will suddenly be cleared to pilot an Airbus A380.

But maybe all that is beside the point. If cloud-first computing gives business users the ability to collaborate with co-workers and to produce better outcomes in less time, let's go for it. In only a few decades we'll have gone from having dumb terminals on mainframe computers to desktop computers with limited abilities to share files to collaborative systems to cloud-based collaboration to cloud-first applications. And how far are we from cloud-only computing?