A security company task force Sophos X-Ops has reported to Black Hat USA 2022 in Las Vegas that ransomware gangs are competing for resources, leading to a trend of victims being attacked by multiple gangs over a short space of time. It even suggested that collaboration between ransomware gangs is possible. The advice to businesses is to patch early and often, monitor cyber security news and respond to alerts, practice segmentation and zero trust and used layered protection, use strong passwords and MFA, and take inventories of all assets and accounts.
All posts by Paul Stradling
Tech Tip – How To Backup Your WhatsApp Conversations
With so many of us using WhatsApp for important business matters, it makes sense to backup chats either on Google Drive or iCloud Drive. Here’s how:
To make a Google Drive backup:
– Open WhatsApp and Tap More options (the three dots).
– Select Settings > Chats > Chat backup > Back up to Google Drive.
– Select a backup frequency other than ‘Never.’
– Select the Google account you’d like to back up your chat history to.
– Tap ‘Back up over’ to choose the network you want to use for backups.
– To turn on end-to-end encryption for your Google Drive backup select > Settings > Chats > Chat backup > End-to-end encrypted backup.
– Tap ‘TURN ON’ and create a password or use a 64-digit encryption key instead.
– Tap ‘Create ‘to create your end-to-end encrypted backup.
To make an iCloud Drive backup:
– Make sure you’re signed in with the Apple ID and iCloud Drive is turned on.
– For a manual back up. Go to WhatsApp Settings > Chats > Chat Backup > Back Up Now.
– For an automatic backup, you can enable automatic, scheduled backups by tapping ‘Auto Backup’ and choosing your backup frequency.
Tech News : 60% Of Us Will Have Digital Wallets By 2026
While some people are busy asking whether we’re seeing the death of cryptocurrencies, a new report says 60 percent of us will be using digital wallets by 2026.
Digital Wallet Usage Driven By ‘Superapps’
A Juniper Research study says that the presence of ‘superapps’ will drive digital wallet use in developing countries that are currently considered cash heavy. Juniper describes superapps as “multipurpose apps able to integrate digital payments alongside other services, including wealth management and eCommerce.” Examples could be WeChat and AliPay (China). WeChat, for example, started as a messaging app, then widened its services to add gaming, shopping, and payments. WhatsApp looks likely to follow a similar road.
Digital Wallet Providers
Examples of some of the leading digital wallet providers are PayPal, Alipay, WeChat Pay, Apple Pay and Google Pay.
Strong Growth
The Juniper report says that the total number of digital wallet users will exceed 5.2 billion globally in 2026, up from 3.4 billion in 2022. If the prediction is correct, this will represent strong growth of over 53 percent.
Rapid Growth For Asia Pacific Region
Juniper’s report also says that the Philippines, Thailand, and Vietnam are primed for rapid growth over the next four years due to the rising access to online and mobile commerce services driving an increase of digital wallets, notably through superapps. The report estimates that the adoption of digital wallets will near 75 percent of the population in each of these countries by 2026!
QR Code Payments
QR code payments are predicted by Juniper’s report to be the most popular digital wallet transaction type in 2026; reaching 380 billion transactions globally, and accounting for over 40 percent of all transactions by volume.
However, the report recommends that QR code payment vendors need to innovate to remain competitive entering new geographic markets by integrating loyalty features and personalised marketing capabilities. These could incentivise merchant acceptance, which could be critical to driving adoption of digital wallets.
What Does This Mean For Your Business?
The pandemic gave a huge boost to digital payment technologies and using QR codes for in-store payment in Asia helped to kick-start the growth of digital wallets, whose users have realised how convenient they are. The Juniper report shows how the growth and popularity of superapps is also a huge driver in the growth of digital wallets, but another important factor in their growth is the fact that they are needed for many different types of digital payment systems, e.g. cryptocurrencies and central bank digital currencies (CBDC). As we move further into an open banking era, this is also facilitating the growth of digital wallets. For many people and businesses in the UK however, using digital wallets is a new and an unknown territory, the trust in which may have been hampered by their association with the apparently volatile world of cryptocurrencies. Some regions of the world, e.g. the Asia Pacific region, are probably more ready for widescale digital wallet adoption in the near future and at the moment for many UK businesses, how much things cost (i.e. rapidly rising prices) are more of an immediate concern than new payment systems.
Featured Article : Pros and Cons of Weakening Encryption
With the Online Safety Bill threatening to undermine end-to-end encryption, we look at the strengths and weaknesses of this security trade-off.
Encryption
Encryption comes from the science of cryptography. In today’s digital world, encryption refers to using electronic devices to generate unique encryption algorithms which essentially scramble messages and data, making them unintelligible to anyone who tries to intercept them, whilst also providing an effective way to lock electronic devices. Encryption can be used for most things which have an internet connection, such as messaging apps, personal banking apps, websites, online payment methods, files and more.
Two Main Types
There are two main encryption methods, symmetric and asymmetric, both of which are made up of encryption algorithms and use prime numbers. It is worth noting that there are many other encryption algorithms and methods including RSA, Triple DES, Blowfish, Twofish, and AES.
Symmetric encryption uses the same (identical) key for encrypting and decrypting data. With symmetric encryption, two or more parties have access to the same key. This means that although it is still secure, anyone who knows how to put the code in place can also reverse engineer it.
Asymmetric encryption uses a pair of keys, one for encrypting the data and the other for decrypting it. For the first key (used to encrypt data), ‘public key’ cryptography uses an algorithm to generate very complex keys, which is why asymmetric encryption is considered to be more secure than symmetric encryption – the process can’t be run backwards. With asymmetric encryption, the public key is shared with the servers to enable the message to be sent, however the private key, owned by the possessor of the public key, is kept secret. The message can only be decrypted by a person with the private key that matches the public one. Different public-key systems can use different algorithms.
The ‘key’ refers to a random but unique string of bits that are generated by an algorithm to scramble and unscramble data. The longer the key, the harder it is to break the encryption code.
Over The Internet – HTTPS
Public key encryption is widely used and is useful for establishing secure communications over the Internet, e.g. for TLS/SSL, which enables HTTPS. For example, A website’s SSL/TLS certificate is shared publicly and contains the public key, but the private key is on the originating server, i.e. it is “owned” by the website.
End-To-End Encryption
Some of the main criticism around the Online Safety Bill’s requirement that platform operators, such as WhatsApp, will have a “duty of care” to “moderate illegal and harmful content on their platforms” is that this will require weakening encryption, i.e. essentially not having end-to-end encryption, thereby creating a major security (and privacy) risk for users.
End-to-end encryption, which is an example of asymmetric encryption (i.e. more secure than symmetric), is used to encode and scramble information so only the sender and receiver can see it, thereby making it highly secure. WhatsApp uses end-to-end encryption and although the messages go through a server, none of those messages can be read by anyone other than the sender and receiver. Allowing content (i.e. messages) to be ‘moderated’ would, therefore, mean that there would need to be a way in, e.g. a ‘back door’, or some other means to view messages between the sender and receiver.
Why Weaken Encryption?
The arguments for weakening encryption (e.g. end-to-end encryption), usually come from governments saying that they need to monitor content for criminal activity and dangerous behaviour; e.g. terrorism, child sexual abuse and grooming, hate speech, criminal gang communications, and more. This could be considered a reason to support the idea of weakening encryption. Examples include:
– When it was revealed that the first London Bridge terror attackers used WhatsApp in 2017 to plan the attack and to communicate, there were calls from the government (Amber Rudd) for ‘back-doors’ to be built-in to WhatsApp and other end-to-end encrypted communications tools to allow government monitoring.
– In June 2021, Police secretly distributed phones with a supposed encrypted app called ANOM installed. The app, however, allowed police to monitor communications about crime including drugs, weapons, money laundering and murder. It led to the arrest of 800 people in a global sting operation.
– In July 2022, Home Secretary, Priti Patel, said “Things like end-to-end encryption significantly reduce the ability for platforms to detect child sexual abuse”.
The Arguments For Not Weakening Encryption
The arguments for not weakening encryption include:
– Consumer protection, e.g. banks protecting financial information and stopping it being accessed or misused when UK citizens bank or make purchases online.
– Many businesses use end-to-end encrypted apps such as WhatsApp and other encrypted communications and VPNs. Encryption, therefore, protects sensitive company data, data privacy, and can reduce cybercrime risks.
– Providing reliable and safe communications in war situations, e.g. secure communication channels in Ukraine allowing broadcasted appeals to the world and recruiting support. Also, encryption has helped Ukrainians to combat disinformation, organise relief efforts, and protect evacuees. The first thing many Russian soldiers are reported to be doing when capturing people is to look at their phones to study their communications and track down associates. This is a good argument for encryption and features like disappearing messages sent via WhatsApp.
– Protection for journalists who need to keep information channels open despite government censorship.
– Protection for activists (human rights) and commentators in oppressive and dangerous regimes.
What Is Being Proposed?
The Online Safety Bill requires tech companies to be able to moderate their platforms or face fines. The government says, with the Bill, the “onus is on tech companies to develop or source technology to mitigate the risks, regardless of their design choices. If they fail to do so, Ofcom will be able to impose fines of up to £18 million or 10% of the company’s global annual turnover – depending on which is higher.”
However, although the UK government says it “wholeheartedly supports the responsible use of encryption technologies” and that it does “not want to censor anyone or restrict free speech,” it is less clear how the government intends to replace protections such as end-to-end encryption with a robust but weaker alternative. For example, the government says “We, and other child safety and tech experts, believe that it is possible to implement end-to-end encryption in a way that preserves users’ right to privacy, while ensuring children remain safe online” and that “tech companies, working in partnership with governments, child protection organisations and law enforcement” appears to be the big idea. The responsibility, backed up with the threat of fines, to come up with a way to enable weakened encryption that is still somehow effective, is being placed on the shoulders of the tech companies who, according to Priti Patel, “now need to stand up and use their resources and engineering expertise” to create a solution.
What Does This Mean For Your Business?
Everyone recognises the need to find ways to stop cybercrime, child exploitation and sexual abuse, and other organised crime that could hide behind encryption to avoid detection. However, encryption also protects the interests and assets of those involved in legal and legitimate activities from criminals and, as Ukraine illustrates, can protect citizens, and provide vital communications in dire situations such as war. Encryption also plays an important role in protecting the sharing of significant news and information, freedom of speech and human rights where there are oppressive regimes. Some would say that the idea of weakening encryption and/or making back doors into apps and allowing monitoring defeats the object of encryption and creates not just a way to stop criminals, but also a way for criminals to get in and steal data. Tech businesses have faced calls from governments to be allowed access before but this time, in the UK, they not only face fines and legislation, but also appear to be under pressure to come up with solutions that could create their own risks. It remains to be seen how the Bill progresses and what the effects of weakened encryption in the UK could be both on those here and in other countries.
Tech News : Google Improves ‘Quoted Search’
Google has made it easier to do quoted searches by adding snippets to search results to help users save time in locating a phrase in a web page.
Quoted Searches
Quoted Searches are searches where the search term is placed within quotation marks to find an exact match in the search engine results. However, although Google Search returns pages with the exact term therein, up until now it has been the case that users have to then search within that page to find whereabouts the exact term is located. Google’s explanation for this is that quoted material can appear in areas of a document that don’t lend themselves to creating helpful snippets, e.g. a word or phrase might appear within the menu item of a page.
Snippets To Show Where Exact Term Appears
Google’s new change to quoted searches means that snippets will be displayed in the search results which show exactly where a quoted word or phrase occurs in a web document, thereby saving users time. For example, if a user searches for [“google search”], the snippet will show where that exact phrase appears. Google also says that on desktop, the quoted material will be shown in bold.
Other Information About Quoted Searches
Although quoted searches have been improved, Google has offered some tips and caveats to accompany its announcement of the change. For example:
– Quoted search results may still match content not readily visible on a page, e.g. a meta description tag, ALT text that describes images, or material brought in through inline frames. Google says in these circumstances, users can try using a standard Find command in a browser or search from within Developer Tools to help find where the exact match phrase occurs.
– Where pages may have changed since Google last visited them, and the exact phrase no longer exists on the current page, users could try looking at the Google cached copy to see where the quoted content appeared on the previous version of the page.
– Quoted terms won’t appear in web page snippets if they only appear within title links or URLs of a web page.
– Google says that although punctuation is sometimes seen as spaces by its system, it will be able to match content where punctuation like commas or hyphens break up words, e.g. don’t, doesn’t, don’t / doesn’t, or don’t – doesn’t.
– If a search involves multiple quoted terms, the snippet may not show all of them if they are far apart from each other.
– Google will mainly show in bold quoted content for web page snippets on desktop.
– Quoted searches don’t work for local results.
– Using quotes may be a useful tool for “power users”, but Google will look for both the exact words and phrases by default anyway.
What Does This Mean For Your Business?
After making the news for a couple of less than positive issues lately (i.e. the Google engineer who said that Google’s LaMDA chatbot was sentient which resulted in his sacking, plus news of a delay in banning third-party cookies), this is a bit of good news, particularly for “power users” of Search. This is essentially a long overdue improvement to one aspect of the search engine results and is timely, considering mobile device users may find it particularly awkward to search whole web pages easily for a phrase. Businesses may also be pleased to know that this is not a ranking change, i.e. it won’t affect ranking position of pages. However, the change may have an impact on click through rate, depending on how the snippets help a user decide how relevant a page could be to their query.
Tech Insight : What is GitHub, GitLab Etc?
In this insight, we take a look at what GitHub and GitLab are, and why they are important in the world of software development.
GitHub, from GitHub Inc., is a not-for-profit website and cloud-based hosting service for open-source development projects – it is the largest open-source host. It helps developers, working on software projects, to store and manage their code, as well as tracking and controlling changes to their code (using Version control), and collaborating on projects.
83 Million Developers Use It
It has been reported that in June this year, GitHub had over 83 million developers using its service and more than 200 million repositories. These included 28 million public repositories. A repository contains all of a user’s project’s files and each file’s revision history.
There are two-connected elements to GitHub – Git and Version Control:
1. Git
The name ‘Git’ refers to an open-source distributed version control system (VCS), created by Linus Torvalds in 2005, the entire codebase and history of which is available on every developer’s computer. Over 80 per cent of developers use Git which can be used to work on software projects of any size. This is why it is the most popular version control software and is often used across the scale of start-ups, enterprise, and others.
2. Version Control
Version control / source control refers to software tools that allows developers to track and manage changes to a software project’s code over time. Version control also enhances communication and collaboration between team members, and facilitates a continuous, simple way to develop software. It also acts as a safety net to protect source code from irreparable harm, thereby giving the development team the freedom to experiment without fear of causing damage or creating code conflicts.
GitHub
Users can access projects on GitHub.com using the standard Git command-line interface, where all standard Git commands work with it. GitHub.com also allows users to browse public repositories on the site, and the site has social networking-like functions including feeds, followers, wikis (using wiki software called Gollum) and a social network graph showing how developers work on their versions (“forks”) of a repository, and what fork (and branch within that fork) is newest.
What Is GitLab?
GitLab is a third-party tool that is the official supported tool of GitHub. It automates the builds, integration, and verification of a developer’s code. It provides SAST, DAST, code quality analysis, and pipelines that enable concurrent testing and parallel execution of code. This means that developer teams can get fast insights about their code, thereby saving time.
What Does This Mean For Your Business?
For developers and teams working on software development GitHub and tools like GitLab provide a vital platform for managing and storing code and for collaborative working. For developers, other great advantages of GitHub are its easy-to-find guides/documentation, plus developers can showcase their work to companies and the public. It also integrates with common platforms like Amazon and Google Cloud. For software developers and those looking for good developers, GitHub is an extremely important platform that has provided the tools that have enabled the development of all kinds of software in a joined-up way.
Sustainability : Graphene For Greener Business?
In this article, we look at how super-strong Graphene can, and is being used to make projects and products more environmentally friendly.
What is Graphene?
Graphene is a one-atom-thick layer of carbon atoms arranged in a two-dimensional honeycomb-style hexagonal lattice. Not only is it the building-block of Graphite, but it is also the thinnest material known to man and is around 200 times stronger than steel! Graphene can be combined with other elements, including gases and metals to produce different materials with superior properties. Graphene was first isolated in 2004 by Andre Geim, and Konstantin Novoselov who won the Nobel prize in physics for doing so.
What Is It Normally Used For?
This super-material is produced by many different companies in different types and grades e.g., high quality single-layer graphene or graphene flakes produced from graphite in large volumes. It has found many uses. For example:
– Sports equipment such as graphene-enhanced tennis rackets, and cycle helmets.
– Paints, electronics, phone screen coatings, flexible displays, solar panels and more.
– As an anti-corrosion covering for some car components, and sensors.
How Graphene Could Help To Make More Projects Environmentally Friendly
One of the main ways that Graphene could help to make projects more environmentally friendly is to be added to other materials to improve their mechanical properties. For example:
– Adding only 0.1 per cent graphene to cement and aggregate, could mean using less materials for same performance. In addition to providing similar strengthening qualities to the concrete as adding carbon fibre, this could reduce the amount of concrete used in construction by 30 per cent, thereby potentially lowering global CO2 emissions by 2-3 per cent. Another benefit of this use of Graphene, due to its strength, could be to remove the requirement for reinforcing steel bars within the concrete in some applications.
– Improving the durability of paints and coatings, keeping rust at bay.
– Being used as a coating for Ford car parts to improve their strength and durability, reducing noise and vibration, and improving heat resistance. The addition of graphene has also made the parts (and the cars) lighter, which translates into less fuel being used and lower CO2 emissions over their lifetime.
What Does This Mean For Your Organisation?
Even though Graphene was isolated 18 years ago, it is still early days in terms of finding its true potential and the breadth of its potential uses. One limiting factor may be the still high cost of producing Graphene. However, we live in a time where green and sustainable solutions must be found to halt global warming and Graphene’s ability to be mixed with other materials to make them stronger, more durable, lighter, and more resistant to heat looks like being its big advantage in terms of making projects more environmentally friendly.
Security Stop-Press : GitHub Users Targeted With Malicious Copies Of Repositories
Cyber security researchers have warned that GitHub users are being targeted with similarly named but malicious copies (containing malicious code) of legitimate repositories. The copied repositories are designed to siphon user environment variables, steal API keys, tokens, crypto keys, and execute arbitrary code on affected endpoints. The advice to developers / GitHub users is to be especially careful when getting code from the platform, and to pay attention to potential typo squats (URL hijacking / cybersquatting), repository copies, clones, or forks (copies of a Git repositories).
Tech Tip – How To Send WhatsApp Voice Messages
If you need to instantly deliver important and time-sensitive information to contacts and groups in WhatsApp, you could use ‘voice messages.’ Here’s how to use this feature:
To send a voice message
– Open an individual or group chat.
– Tap and hold the microphone and start speaking.
– Once finished, remove your finger from the microphone.
– The voice message will automatically send.
– If you need to cancel the message while recording it, slide left.
To send a longer voice message
– Again, open an individual or group chat.
– Tap and hold the microphone and start speaking.
– This time, slide up to lock hands-free recording.
– Tap the red pause button to pause recording or preview a draft of your message.
– Tap the red mic icon to continue recording within the same voice message.
Tech Insight : Spotting Fake Reviews And Dubious Ratings On Amazon
Following Amazon suing the admins of more than 10,000 Facebook groups over an alleged co-ordinated fake reviews campaign, we look at how to spot fake reviews and dubious ratings on Amazon.
Why Use Fake Reviews?
On the site of one of the world’s largest retailers and the top online marketplace, large numbers of positive reviews and five-star ratings can give sellers a competitive edge that brings in greater profits. Those who write the reviews on behalf of sellers can receive benefits like money, refunds, and free products.
How Big Is The Problem?
Only Amazon has that data for the true scale of the problem, however, fraudulent-review-detection service Fakespot suggests that around 42 percent of 720 million Amazon reviews assessed in 2020 were fake.
Damaging
Fake reviews can be damaging to buyers, other sellers, and Amazon’s platform. For example, fake reviews:
– Promote products to the top of the list which may not best match the customers’ needs and may not be the best quality or value for money. This can lead to buyers purchasing low-quality products that leads to dissatisfaction.
– Can mean that Amazon retailers who are selling a higher quality product have greater difficulty standing out among competitors with falsely positive reviews, thereby hitting their revenue.
– Lead to some retailers being negatively affected when some competitors post fake negative reviews about their products.
Common Ways To Spot Fake Reviews and Dubious Ratings
Common ways to spot possible dubious ratings and fake reviews include:
– Look at the percentage of 1- to 5-star reviews. If a listing shows hundreds or thousands of reviews with only five-star reviews, or if, say, 70 per cent of the reviews are 4 or 5 stars, and only 30 per cent are 1-star reviews, this is an unusual pattern, and one to be wary of. If a product only has 5-star reviews, this could be suspicious.
– Vague reviews, e.g. just using short comments like “Love it!” or “Great” could be a sign that they are fake.
– Beware reviews that mention a competing brand or product and warn you not to spend money on it.
– Study the negative reviews and filter the reviews by 1-star ratings. If there appears to be a common pattern, e.g. reviewers repeatedly reporting deficiencies in the product, this could be a sign that all is not as it should be.
– Beware ‘merged reviews.’ This is where there are multiple variations of a products, and a seller may have merged the listings together, manipulating the review to make it seem as though there are more good ratings on the product that is being sold than it has. This means that many of the ratings for a product may be for one that’s totally unrelated. By reading several of the reviews, this can often reveal which product the reviews are about.
– Check the pattern of ratings. If there are substantial amounts of ratings at different ends of the scale – highly positive and highly negative – with nothing in between, this polarisation about a product could be sign of fake reviews.
– Read and search comments for any mentions or comments about the buyer receiving a gift card or a free product in exchange. This could be a sign that sellers have been incentivising customers who have bought their products, e.g. by using inserts for a gift card or a free product in exchange for a good review.
– Check the dates of when reviews were posted. If many were posted in a short time period, this could be a sign that there was a push for reviews on Facebook groups or other platforms.
Using Third-Party Websites and Browser Extensions
There are several websites and browser extensions that can be used to identify fake amazon reviews. These include:
– Reviewmeta. Users can paste the Amazon product page URL into a search box to analyse the users’ reviews.
– Fakespot. This is a browser extension that can be used to spot fake reviews on a variety of websites, including Amazon and eBay.
– The Review Index. Like Reviewmeta, this analysis tool works by copying and pasting the product link into the search bar.
What Is Amazon Doing About Fake Reviews?
In addition to suing the admins of more than 10,000 Facebook groups, other measures that Amazon has taken to tackle fake reviews and dubious ratings include:
– Banning paid-for reviews that are outside of its Vine program.
– Introducing a ‘disclosure’ informing customers when a reviewer has been incentivised.
– Restricting eligibility to review a product to customers who have spent at least £40 on the site within the last 12 months.
What Does This Mean For Your Business?
Fake reviews and dubious star ratings appear to be quite difficult for Amazon to stop, thus it is a problem that has grown following the pandemic years as some third-party sellers tried to get a get a competitive edge and cash-in on the surge in online shopping that the pandemic created. Clearly, it’s still possible for many people (if Amazon’s suing 1000+ Facebook Groups) to find ways to manipulate the ratings. It may be difficult in the short term to detect and stop practices like including inserts with products offering incentives for good reviews (unless they’re reported or mentioned online) or using merged reviews. Manipulation and fake reviews, however, are unfair, but are still rewarded by Amazon which is why they are still happening. In addition to making it more difficult for sellers who are operating honestly, plus affecting customers who may be buying inferior products due to fake reviews, criticism about the matter is damaging for Amazon’s reputation. Clearly, users of the platform (both sellers and buyers) would welcome the introduction of more and better measures to filter out and prevent fake reviews and ratings. In the meantime, as buyers, we can only continue looking out for the signs mentioned in this article, and perhaps consider using websites like Reviewmeta if the purchase is an important one.