Monthly Archives: October 2021

Reading Time: 6 minutes

151 isn’t the biggest number in the world, but it’s not the smallest either. 10.5 million? That’s a big number indeed and where we are going with this is that there in an ongoing fraud campaign making its way around the web right now called Ultima SMS that people should be made aware of given the sheer scale of it and just how many people could be affected. 151 is the number of Android apps that this campaign has been identified with (so far) and that 10.5 million figure is the number of times those specific apps have been downloaded.

Most malware is much more deliberately malicious, but that’s not to take away from the seriousness of Ultima SMS and why people should be made aware of it (and why we’re choosing to make it our subject this week). Here at 4GoodHosting we’re like any good Canadian web hosting provider in that we know that people don’t like surprises when they’re the type that end up costing them more money. That’s what makes the Ultima SMS subscription scam so noteworthy – it upgrades users to premium subscription memberships without them being aware of it.

Now the question obviously becomes what would be their gain in doing this. They get a cut from the monies gained by increasing subscription rates involuntarily. Instead let’s look at those very newsworthy scam, as security concerns related to apps downloaded 10+ million times definitely makes it newsworthy.

Gone – Just Not Quickly Enough

The good news here is that Google wasted no time in removing the apps, but those multi-million downloads have worked out to millions of dollars in fraudulent subscription charges already. The way they drew unsuspecting users to the bait was with discount apps, games, custom keyboards, QR code scanners, video and photo editors, spam call blockers, camera filters, and more.

Once one of the affected apps was launched for the first time and using mobile data, the location and IMEI is changed to match the language of the country. The app would then prompt the user to enter their mobile phone number and email address to become aware of the program’s features and gain access to them.

Then once the phone number is obtained along with the required permissions, the app proceeds to subscribe the victim to a $40 per month SMS service. And, as mentioned, the scammers get a cut as an affiliate partner. It’s also recently been determined that the app authors have put into place a system that hits the victim with the maximum charge amount based on their location.

The sheer volume of submissions is what’s making this work, as apparently many of the apps and their ‘offerings’ aren’t particularly good in the first place. The aim is to have a constant inflow of unsuspecting victims and preserving their presence on the Play Store despite the constant reporting and take-down actions.

Some Spots Worse

Not surprisingly, it’s not a scenario where the entire world is being affected by this equally. The countries that are currently most affected by the Ultima SMS scam are:

• Egypt
• Saudi Arabia
• Pakistan
• UAE

So while we can safely assume there’s a whole lot of unwanted premium subscriptions going on in the Middle East and moving into South Asia, it’s also estimated that nearly 200,000 devices are affected in North America.

Uninstalling the app will prevent new subscriptions from being made. However, it will not prevent the existing subscription from being charged again. This is where the hang-up is, you need to contact your carrier and ask for a cancellation of all SMS subscriptions.

Best Avoidance Practices

Falling victim to this kind of stuff can happen to anyone, and if it does you’ll be best to smarten up regarding avoiding online pitfalls like this one. Here is what industry experts say are best practices for doing that:

151 isn’t the biggest number in the world, but it’s not the smallest either. 10.5 million? That’s a big number indeed and where we are going with this is that there in an ongoing fraud campaign making its way around the web right now called Ultima SMS that people should be made aware of given the sheer scale of it and just how many people could be affected. 151 is the number of Android apps that this campaign has been identified with (so far) and that 10.5 million figure is the number of times those specific apps have been downloaded.

Most malware is much more deliberately malicious, but that’s not to take away from the seriousness of Ultima SMS and why people should be made aware of it (and why we’re choosing to make it our subject this week). Here at 4GoodHosting we’re like any good Canadian web hosting provider in that we know that people don’t like surprises when they’re the type that end up costing them more money. That’s what makes the Ultima SMS subscription scam so noteworthy – it upgrades users to premium subscription memberships without them being aware of it.

Now the question obviously becomes what would be their gain in doing this. They get a cut from the monies gained by increasing subscription rates involuntarily. Instead let’s look at those very newsworthy scam, as security concerns related to apps downloaded 10+ million times definitely makes it newsworthy.

Gone – Just Not Quickly Enough

The good news here is that Google wasted no time in removing the apps, but those multi-million downloads have worked out to millions of dollars in fraudulent subscription charges already. The way they drew unsuspecting users to the bait was with discount apps, games, custom keyboards, QR code scanners, video and photo editors, spam call blockers, camera filters, and more.

Once one of the affected apps was launched for the first time and using mobile data, the location and IMEI is changed to match the language of the country. The app would then prompt the user to enter their mobile phone number and email address to become aware of the program’s features and gain access to them.

Then once the phone number is obtained along with the required permissions, the app proceeds to subscribe the victim to a $40 per month SMS service. And, as mentioned, the scammers get a cut as an affiliate partner. It’s also recently been determined that the app authors have put into place a system that hits the victim with the maximum charge amount based on their location.

The sheer volume of submissions is what’s making this work, as apparently many of the apps and their ‘offerings’ aren’t particularly good in the first place. The aim is to have a constant inflow of unsuspecting victims and preserving their presence on the Play Store despite the constant reporting and take-down actions.

Some Spots Worse

Not surprisingly, it’s not a scenario where the entire world is being affected by this equally. The countries that are currently most affected by the Ultima SMS scam are:

• Egypt
• Saudi Arabia
• Pakistan
• UAE

So while we can safely assume there’s a whole lot of unwanted premium subscriptions going on in the Middle East and moving into South Asia, it’s also estimated that nearly 200,000 devices are affected in North America.

Uninstalling the app will prevent new subscriptions from being made. However, it will not prevent the existing subscription from being charged again. This is where the hang-up is, you need to contact your carrier and ask for a cancellation of all SMS subscriptions.

Best Avoidance Practices

Falling victim to this kind of stuff can happen to anyone, and if it does you’ll be best to smarten up regarding avoiding online pitfalls like this one. Here is what industry experts say are best practices for doing that:

• Stay vigilant – be wary of apps advertised in short and catchy videos
• Disable premium SMS options with your carrier – by doing this you’ll be well defended against anything similar, and this is a really smart move in general if your children handle your device from time to time
• Check reviews – written reviews may reveal the true purpose of an app
• Hold off on entering your phone number – if you don’t trust an app you should choose to not share personal details with it
• Go over fine print – it is helpful to know that legitimate apps almost always have a Terms of Service and a Privacy Policy, as well as a statement about how user submitted information will be used
• Use Official App Stores only – As mentioned, the offending apps are no longer on the Google Play Store, but you can be sure they’re still able to be found elsewhere

Reading Time: 4 minutes

Cyber security is certainly turning out to be one of the buzzwords of the 21^st century, or at least so far and depending on whether you’re in certain circles. It is also certainly something that anyone running a business would have never even heard of or had to consider in the days before businesses started to up shop along the Information Superhighway. But nowadays nearly all of them who have taken their business online will be all to familiar with terms like malware, ransomware, and the like. There’s always going to be bad actors but nowadays they’re a whole lot more inconspicuous in the digital space.

There’s been plenty of documented cases where big businesses have taken big hits because of cyber attacks, but fortunately cloud computing technology has really stepped up to be a valuable and powerful ally in the fight against cyber crime. The reason this is noteworthy for us here at 4GoodHosting is the nature of what we do lends itself to taking an interest in something that will definitely be a forefront issue for those websites hosted and in operation because of e-commerce interests. We imagine this would be true for any good Canadian web hosting provider.

So we figured this would be an excellent topic to delve into for this week’s entry, and explain in more detail how having the benefits of cloud computing on the side of Enterprise security is such a big plus for anyone who has reasons to be concerned about how air-tight their website and data related to their business operation is or is not depending on the circumstance.

New Rules

Enterprise organisations today have no choice but to play by a new set of cyber and physical security rules. There’s not stopping the advances hackers are making, and they will continue to find new and faster ways to get past security protocols. It’s fair to say now that traditional models where cybersecurity and physical security teams operate as separate entities can no longer ensure being defended against the most recent and revamped threats. Converged cyber and physical security teams are great, but a key piece of a successful security strategy is having the right technology and tools.

The Cloud is a counter to those expanding risks, and we are beginning to see how platforms and software that run in the cloud are making it easier for businesses to identify breaches and take action much more speedily. There are 5 different ways cloud-based technology is making a real positive difference with cyber and physical security strategies today.

So let’s have a look at those

1. Cross-Platform Integrations

The rise of IoT and cloud-based tech has enabled progress towards better communication system like nothing else that might have come before it. Integrating security systems and software tools creates a more unified platform that is easier to manage and control. Integrated systems also take the weight off IT teams, bringing multiple systems into a single dashboard. We’re seeing how integrating access control and video surveillance systems allows teams to visually verify events as they are happening, with real-time video paired with all access activity.

Access control, video surveillance, alarm systems, building management, identity management and provisioning, and cybersecurity tools are among the best cloud-to-cloud integrations that promote the streamlining of business operations.

2. Auto Patching and Software Upgrades

When it comes to mitigating a security breach every minute is crucial. Outdated technology can mean it taking hours or even days only to determine the breach has happened, and with nothing in the way of assessing the damages and running audits as necessary. Among the cloud’s best benefit in this regard is that firmware and software updates can be completed over-the-air, making it so that systems are always running the latest security features for optimum protection from the newest vulnerabilities.

Automatic updates are also integral to making enterprise security technologies are evergreen. Rather than needing to replace hardware every 2 or 3 years, the latest features are available with a few clicks. We see businesses using a cloud-based keyless entry system rolling out features and product updates that can thwart modern threats and safety hazards, and that happens without physical hardware upgrades or anything else of the sort being required.

3. Remote Data and Control Access

The new realities of running a business means that having staff onsite for every single task just isn’t practical or doable. When operations that can be done remotely a business becomes more agile and adaptable. Being able to decentralise operations across multiple locations is hugely beneficial for cyber and physical security. The Cloud offers exceptional remote access compatibility, and this has inherent benefits with the way it also makes better security protocols less demanding for the people who have to see to them.

4. Leveraging IoT Automations

No one’s going to argue that automations are the future, and manual processes are going to be few and far between in the future. Scalable business that get a leg up because of that scalability are going to be the ones successful with automations. Cloud-based cyber security systems are generally more dynamic and require less labor to execute automations. For example, a scalable security strategy should include automatic alerts for access events, the ability to automatically disable and deactivate old credentials or accounts, along with automatic alerting and routing for emergency procedures.

Intuitive cloud-based software can promote a simple rules engine that makes setting up these automations super simple, and they can be easily adjusted at any time.

5. AI-based Monitoring / Detection

Artificial intelligence is expanding in leaps and bounds, and installing Al systems delivers the benefit of having technology that will learn based on your specific business and trends. Then when it is paired with integrations it becomes a scenario where AI-powered detection tools can help identify security issues faster, and improve response accuracies.

Today’s AI-powered video surveillance can detect nearly anything. Smarter analytics go beyond monitoring, as AI analytics tools work very well for identifying key trends in attendance and space usage. This is then helpful for making key business decisions. When it comes to meeting business goals and ROI, the right security tools are an important factor in reducing costs while creating more efficient and scalable systems along with them.

Reading Time: 3 minutes

Neither of the two giants in Apple and Microsoft do much in the way of making their devices easily repairable or upgradeable, and while trying to keep their stuff proprietary as much as possible is understandable it’s not good how so many PCs and other computing devices are discarded and end up as electronic waste instead of being repaired. The basics of electronic device repair aren’t that difficult to get, and you might be surprised what can be done with know how, a steady hand and some soldering skills.

Working on devices that are able to access the web is a huge part of daily life for so many people, and it will be beneficial to try and limit the amount of e-waste we create when getting rid of ones that could still have a longer working life. This is why it’s good news that Microsoft has announced that they are going to make desktop and notebook PC repair much more accessible to people. This will also have huge benefits for providing fully functional computing devices to developing regions of the world where they will assist with education and other interests.

Trying to minimize their environmental footprint is a priority for any quality Canadian web hosting provider in the same way it is for all businesses these days, and at 4GoodHosting we see the value in making people aware of news like this that is in line with environmental interests related to digital devices. E-waste is a problem, and it is going to be very beneficial if people can have their computers and other devices repaired more easily so they don’t have to keep buying new ones and furthering the cycle.

Around a Trend

A large portion of the carbon emissions associated with the devices we own are made during manufacturing. Replacing products before the more real end of their working life causes those emissions, pollution, natural resource use, and land degradation associated with extracting and refining raw materials go way up and there is more toxic e-waste polluting the environment in places like Agbogbloshie, Ghana and Guiyu, China.

The White House is already moving towards legislation that will have the US FTC dismantling repair restrictions around phones and electronics, and this is something that has long been needed here in North America and around the world. It’s also about ensuring that lower income families or individuals can have the same degree of web connectivity to go along with the basic rationale of being able to repair something you use as a tool in the same way you do your motor vehicle.

Both take you to destinations in a sense. The reason you’re soon going to be able to take Microsoft products to 3^rd-party repair services OR fix them more easily yourself is because of As You Sow, an activist group that promotes companies being more aware of the environmental degradation levels that come excessive e-waste resulting from the shortened lifespans of devices. They were able to make this request as part of an original shareholder resolution that they were entitled to present.

Their request is that Microsoft analyze the environmental benefits of making its products easier to repair, and now Microsoft is promising to ‘expand the availability of certain parts and repair documentation beyond Microsoft’s Authorized Service Provider network.’ They are also going to offer new mechanisms to enable and facilitate local repair options for consumers, allowing them to have their Microsoft devices repaired outside what is now a limited network of authorized repair shops.

Right to Repair Movement

Just this summer US President Joe Biden issued an executive order instructing the Federal Trade Commission to craft new rules around addressing unfair anticompetitive restrictions on third-party repair and as of right now 27 states are looking at passing right-to-repair bills, and New York has introduced the first-ever national right-to-repair bill that targets all sorts of consumer products that should be repairable if parts are made more readily available from the manufacturer.

A similar type of request has been made to Apple, and industry experts say it is very likely that all major manufacturers will need to be able to prove they are operating in a more ecologically friendly manner. All sort of consumer electronics should be made easier to fix yourself, and although that will mean fewer products being produced and sold it really is high time that something like this happens considering just how problematic planned obsolescence and the like really are.

We are definitely fans of the Right to Repair Movement, and we’re happy to see that there are similar movements here in Canada that are pushing for the same sort of outcomes. If you don’t already have a soldering iron at home, it might be time to get one.

Reading Time: 4 minutes

Ever since the web was in its infancy and URLs were just starting to be a thing, internet names that are TLDs (Top Level Domains) are administered by ICANN, a centralized organization that has outlived its usefulness for managing internet names in the opinion of many knowledgeable people in the industry. It’s only very recently that legitimate alternatives to this monopoly of-sorts have come into existence, but the one that’s really generating some buzz these days is Handshake.

It is the exact opposite of ICANN, and in particular with the way it is a decentralized naming solution for the Internet that is powered by blockchain technology – another major disruptor in the industry that we’ve also touched on here on a number of different occasions. HNS is the abbreviation for the Handshake naming system, which is a peer-to-peer network and decentralized system using blockchain as a means of offering better control, freedom, and security of the domain and website.

As you’d expect, this sort of development is the type that comes up immediately on radar for those of us here at 4GoodHosting in the same way it would for any good Canadian web hosting provider that likes to have its thumb on the pulse of web hosting technology and options that become available to people who need to claim their spot on the web and use it to their personal or business advantage. The appeal of HNS naming is that it is line with decentralizing the web and allowing for a more fair reorganizing of the Internet.

So how does Handshake domain naming work, and what exactly make it better for individual users? That’s what we’ll look at this week.

Handshake Domains – How Do They Work?

Let’s start here with a basic refresher on domain names. All websites accessible on the Internet are found on servers identified using Internet Protocol (IP) addresses. Users aren’t expected to know IP addresses, so internet names are mapped to their corresponding servers by means of a domain name system (DNS). DNS is not centralized, but the ultimate control of names via the DNS system is held by a limited number of interest groups and they don’t always act equitably.

The Handshake name system is entirely different by design. While it also maps names to IP addresses and can be utilized in essentially the same way as the traditional DNS, names are administered by a blockchain model instead of a single centralized entity. What is key here is how Handshake takes decentralized control of the root zone and can then be used for so much more than just mapping to servers in the internet space.

As a decentralized, permissionless naming protocol where every peer is validating and in charge of managing the root DNS naming zone, Handshake meets a much more agreeable vision of how the control of TLDs is made available in a more fair system and one that doesn’t favor some greatly at the expense of others.

It’s really starting to emerge as an alternative to existing Certificate Authorities and naming systems, and it’s a darn good thing.

 

Distribution of Handshake Names

There is more of a chance with name ‘squatting’, and the Handshake protocol reserves the top 100K domain names according to Alexa.com as well as giving priority on existing TLDs to current owners. As a result and to use one example, Google – which currently leases google.com from Verisign, the controller of the .com TLD – can instead lay a claim to the ‘Google’ name via the Handshake blockchain.

This can be applicable for less competitive domain names too, with the blockchain facilitating name auctions which can be bid on by anyone who is in possession of Handshake tokens. This would deliver a very different owner, user, and visitor experience right across the board, but what is interesting to note is that with an HNS the internet user would be navigating to a website in an entirely decentralized manner and with nothing in the way of censorship related to a centralized authority.

Entities that are currently in existence and able to take domain names away from owners under the current ICANN style of governance would be rendered powerless by a Handshake domain name system powered by blockchain. If you’d like to learn more about uncensorable domain names you can find quite a bit of information out there.

Accessing a Handshake Name Using my Browser

You need to be behind an HNS resolver to access a Handshake name in any internet browser. This is possible with running your own HNS resolver on your device. You can also choose to configure your browser to use a DNS-over-HTTPS server that resolves Handshake names. Easyhandshake.com is one example of such a server and people with even a little bit of domain hosting savvy can easily figure out how to start using DNS-over-HTTPS to resolve Handshake names.

Several developers have rolled out browser extensions to allow standardized access to Handshake sites. Bob Wallet and LinkFrame are examples of two available for Google Chrome, and for Mozilla FireFox you’ll find that Resolvr works very well. Last mention here will be for Fingertip – an open-source, lightweight HNS resolver developed by Impervious and compatible with both Mac and Windows OS.