It is now ILLEGAL to share your Netflix, Disney+, other passwords with friends and relatives

Photo by Rowan Heuvel on Unsplash

The UK government body overseeing intellectual property rights in the UK, the Intellectual Property Office (IPO), released new guidance on piracy and online counterfeit goods, a joint campaign with Meta, owner of Facebook.

The issue of piracy is generally about the use of illegal streaming boxes and apps and how these 1) expose children to inappropriate content and 2) risk putting sensitive personal information in the hands of criminals. UK legislation now also flags password sharing as piracy, as TorrentFreak pointed out. It is therefore illegal, and a potential crime, to share your Netflix and/or Disney+ login details with your friends and relatives.

A section of the new piracy guidance from the UK government’s Intellectual Property Office (IPO) (Source: GOV.UK)

TorrentFreak was told by the IPO: "There are a range of provisions in criminal and civil law which may be applicable in the case of password sharing where the intent is to allow a user to access copyright-protected works without payment.

These provisions may include breach of contractual terms, fraud or secondary copyright infringement depending on the circumstances."

Section 11 of the Fraud Act of 2006 in the UK considers it a fraud if someone uses "services of a members' club without paying and without being a member".

It is  not very likely that streaming services will to start dragging to court those who are sharing passwords, or "moochers" (individuals borrowing a subscriber's credentials). Still, the guidance could well serve as a deterrent for people who are sharing their subscription details with friends or relatives.

Risky business

Sharing one’s streaming service login details with others is risky business (security wise) for subscribers and usually yields negative results for the service provider.  These providers lose money as long as they let this password sharing go on. According to a survey from Beyond Identity, streaming service providers lose, on average, some $640 per 'moocher' annually. In some cases they could lose as much as $700 a year!

The cost of piracy, as estimated by Parks Associates, in US alone, was $9.1B in 2019. The amount is estimated to increase to $12.5B by 2024.

No wonder they are cracking down on password sharing!

In October, Netflix announced its intention to start doing just that soon. The company has already introduced features to members in certain Latin American countries where they can share their account details with others safely and legally: a new profile can be added to their account for an added cost. Netflix may well roll out this provision in other countries.

"[Streaming services] don’t necessarily want people to go elsewhere," Paul Erickson, the Research Director of Entertainment and Consumer Technology at Parks Associates, said in an interview. "We'll see them navigate that difficult middle ground where they’re not trying to give the service away, but they’re also not trying to drive people away either."

So be prepared!

It looks like it is going to be more difficult to share you password. Or, at the very least, you may have to pay for doing so. 

There is, off course, the risk of getting a criminal record...

Gone phishing...

Like me, you probably receive loads of 'dodgy' emails purporting to be from a genuine source.

How do you spot a scam, a 'phishing' email?

Phishing emails are designed to appear as real companies or individuals to defraud you by stealing your personal information or enticing you to download attachments that contain viruses or other malware.

How to spot a phishing email:

• Do you have an account with this company or know the individual?
• If so, are you expecting this email?
• Check the email sender address to see if it is legitimate.
• Be wary of attachments, especially if they are oddly named.
• Is the email generic?
• Are the grammar and spelling correct?
• When you hover on any links, it will show the URL. Is this URL linking to a site that you expect and trust?

If you believe that you have received a phishing email, please report the email (in the UK it is as simple as forwarding it to report@phishing.gov.uk), block the sender and delete the email if it has not been removed.

Many trusted companies, especially financial institutions, offer what is called "two factor authentication". 

This is a two-step process that provides an extra layer of security for you when accessing your account. When set up, you will be required to enter an additional password that will be sent to your mobile/cell phone to log into your account.

It is strongly recommended that you enable this two factor authentication, if offered, to ensure that your account can only be accessed by authorized persons, even if your information has been stolen.

A bug is about to confuse a lot of computers!

 

Turning back the time some 20 years

Remember the fuss about the Y2K bug?

The US Cybersecurity & Infrastructure Security Agency (CISA) has issued a warning to users who get the time from GPS, about a “GPS Daemon” (GPSD) bug in GPSD versions 3.20 through 3.22.

The “Y2K” bug

Prior to year 2000, lots of computer programs kept track of the year by remembering just the last two digits of the year (“99”, instead of “1999”). These programs would work correctly until the first day of the new millennium, and then revert back to 1900!

Though some computer programs don’t care what time it is, there was genuine fears that things would go horribly wrong - the power grids would shut down, planes would fall from the sky, the banking system would grind to a halt, and so on.

In the end, none of that happened because everyone received warnings well in advance and there was enough time to take action.

What’s the bug now?

In addition to telling you where you are in space, the Global Positioning System (GPS) can also tell you where you are in time. To do this, it keeps a count of the number of weeks since January 5, 1980. The main civil GPS signal broadcasts the GPS week number using a 10-bit code with a maximum value of 1,023 weeks. This means every 19.7 years, the GPS week number in the code rolls over to zero.

GPSD is a GPS service daemon for Linux, OpenBSD, Mac OS X, and Windows. It collects data from GPS receivers and makes that data accessible to computers, which can query it on TCP port 2947. It can be found on Android phones, drones, robot submarines, driverless cars, manned military equipment, and all sorts of other embedded systems.

But now a flaw in some versions of GPSD could cause time to roll back after October 23, 2021. The vulnerable versions of the code seem to subtract 1024 from the week number on October 24, 2021. This would mean Network Time Protocol (NTP) servers using the faulty GPSD versions would think it’s March 2002 instead of October 2021!

Is it going to be really bad?

For computer systems that have no other time reference this could cause a number of security issues. From the perspective of incident handling and incident response, well-synchronized time across systems facilitates log analysis, forensic activities and correlation of events. Losing track of what happened when, can lead to missed incidents.

Even worse: NTP servers using the faulty GPSD version could get thrown back almost 20 years. Many businesses and organizations rely on NTP’s. Some authentication mechanisms also rely heavily on time. Users might therefore not be able to authenticate and gain access to systems.

This could also happen where authentication relies on cookies. Websites and services relying on expiring cookies do not respond well to cookies from twenty years in the future.

What to do

Since the affected GPSD versions are 3.20 through 3.22 users should upgrade to version 3.23.1. Organizations that use GPS appliances or rely on GPSD are urged to check if GPSD is being utilized anywhere in the infrastructure and check its corresponding version. An upgrade to GPSD may be required.

If you are a system administrators you’d do well to make a note of the date October 24, 2021. If systems start to have authentication issues after that, it could be due to a mismatch in date and time.

 

Are your children safe online?

Is your child safe when they're online alone?

How would you know?

The Internet is an haven for child molesters, sexual offenders and pedophiles.

Right now, these sexual predators are trolling the net looking for a child just like yours!

But there is a software program that can help keep our kids safe when they go online.

Watch the video below.

With PC Tattletale, it has never been easier to see every click and keystroke pressed.

PC Tattletale makes it easy to see every click from their computer, social media, email, the web, and more.. 

Watch everything your kids do on the computer.

To learn more, click here

Did you know that...

About 1 in 5 children were solicited for sex in the past year while online?

Or that the FBI estimates that there are over 1 million sex offenders online?

Or that by the time they reach 15 the average teen has been exposed to hundreds hard core images

Protect your kids when they go online:

PC Tattletale

Beware of The "Secret Sister Scam"

The festive season is imminent and with it many scammers and fraudsters that want your hard earned money.

It’s a Facebook Secret Sister (not Santa) you especially have to watch out for. Secret Sister has been a mainstay of Yuletide scams since at least 2015, and has come back around once more. But what is it?

How the scam works

Chain letters of the Secret Sister variety land in your digital mailbox as opposed your real one. You could in theory receive one of these anywhere, and people have reported receiving them on everywhere from Reddit and Facebook to various social portals and forums. For whatever reason, Facebook seems to be the scammer’s favourite place to get the ball rolling. The possibility of being able to send it pinging around large social connection chains is too good to resist.

Secret Sister sample 

The messages can vary wildly, but one of the most popular ones going back a year or so reads as follows:

Anyone interested in a Holiday Gift exchange? I don’t care where you live – you are welcome to join. I need 6 (or more) ladies of any age to participate in a secret sister gift exchange. You only have to buy ONE gift valued at $10 or more and send it to one secret sister and you will receive 6-36 in return!

Let me know if you are interested and I will send you the information!

Please don’t ask to participate if you are not willing to spend the $10.

'TIS THE SEASON! and its getting closer. COMMENT if You’re IN and I will send you a private message. Please don’t comment if you are not interested and aren’t willing to send the gift!

It might sound promising to many people reading it, but it really won’t do you much good.

From chains to pyramids

Chain letters are essentially pyramid schemes. Pyramid schemes involve funneling money from bottom to top of the pyramid, benefiting those at the top and not many others. If you’re there from the get-go, your chances of making a good return increase somewhat. For everyone else, you’re probably going to lose out.

Where this becomes complicated is in the US is these schemes tend to resemble gambling. This means you could easily end up breaking the law. From the US Postal Inspectors website:

They’re illegal if they request money or other items of value and promise a substantial return to the participants. Chain letters are a form of gambling, and sending them through the mail (or delivering them in person or by computer, but mailing money to participate) violates Title 18, United States Code, Section 1302, the Postal Lottery Statute

Secret Sister data harvesting

You definitely won’t receive a pile of free gifts. However, you could be dragged into some sort of dubious postal scam with mail fraud penalties instead. There’s also the risk of identity theft to consider. Mail fraud scammers typically ask for various pieces of personal information. You could end up handing them your name, address, phone number, alongside a variety of online profiles to tie them to. This could be all an enterprising criminal needs to do some additional damage, especially if they persist in branching out from your profile to those of your friends.

No matter how appealing the prospect of easy free gifts sounds as 2018 slowly draws to a close, don’t fall for it. These types of antics have been around for a long time, and moving into the digital realm doesn’t make them any safer. If you’re not based in the US, you may not have the legal worry to deal with as a result but that’s scant consolation.

Our advice is to give his sister nothing more than a Return to Sender.

Source: https://blog.malwarebytes.com

Meltdown and Spectre - How to protect against these CPU security flaws

Metldown and Spectre CPU security flaws are currently making headlines around the world. How do you protect your device from these issues?

What are Spectre and Meltdown?

Spectre and Meltdown are flaws found in processors from Intel, ARM and AMD that could allow hackers to access passwords, encryption keys and other private information from open applications.

These flaws are sending shock waves through the IT world. Actually, it was revealed that they had been present in chip designs for the past 2 decades! It was also revealed that they affect a number of companies’ processors, therefore the flaws could be found on a massive number of devices, from PCs to web servers and even smartphones.

Should Spectre and Meltdown worry me?

You shouldn’t need to panic, because so far it doesn’t look like Spectre or Meltdown have been used in an attack, and device manufacturers are working with Intel, ARM and AMD to fix these flaws.

Intel has claimed that the exploits can't corrupt, modify or delete data. Though, it has emerged that Spectre may need a processor redesign to fix.

However, this does mean that future processors will be free from the Spectre and Meltdown security flaws. So, don’t worry too much!  Still, be aware of any updates for your devices and protect yourself against the Meltdown and Spectre CPU security flaws following the advice here.

Protect yourself against the Meltdown and Spectre CPU security flaws...

... on Android phones:

Google will release a new security update on January 5 that will help protect your Android Phone against Meltdown and Spectre.

If you have a Google-branded phone, such as the Nexus 5X or the Pixel 2 or Pixel 2 XL, then you should get the update promptly, and on Google’s newer devices the update should download and install automatically.

Open the settings app on your Android device, go to ‘System’ and see if you can find new updates waiting for you. It may also be worth following your phone manufacturer on Twitter to keep up with news about the update.

...on iPhones:

Apple has has admitted taht Meltdown and Spectre are affecting all iPhones.

Apple also revealed that it had already released ‘mitigations’ for Meltdown in iOS 11.2, so make sure you keep an eye out for any new updates made available for iOS on your iPhone or iPad, and go into 'Settings' to check what version of iOS you are running.

Apple didn't say it had a fix for Spectre just yet, but it mentioned that “We continue to develop and test further mitigations for these issues and will release them in upcoming updates of iOS, macOS, tvOS, and watchOS.” 

... on Windows PCs:

Windows PCs are likely to be hit hardest by Meltdown and Spectre, regardless if they run on Intel or AMD processors. The good news is that Microsoft seems to be on the case and has said that it has already released a security update on Wednesday for Windows 10, as well as previous versions of Windows.

Windows 10 should download the update automatically, but to be sure, type ‘windows update’ in the search bar of the taskbar, and select ‘Check for updates.’ Download and install any new updates it finds.

... on Macs:

Macs have also been affected by Meltdown and Spectre, and Apple has released a statement admitting the fact that all Macs have been affected.

While this is worrying, Apple also added that it has already released a series of fixes in macOS 10.13.2, so keep an eye out in the Mac App Store for any updates to OS X or macOS, and make sure you’re running the latest version of the operating system.

... on Chromebooks:

Recent Chromebooks should be automatically protected from Meltdown and Spectre, as Google released Chrome OS version 63 in December, which has features included to avoid these flaws.

If you want to know if your Chromebook is updated to version 63, or if an update is coming, check out Google’s list of Chrome OS devices, and check that it says ‘yes’ in the last column.

Following the advice above should help you to stay protected against Meltdown and Spectre.

This blog also has links to several world class Anti Virus software programs (like Zone Alarm) that can help you stay protected against future attacks.

Traditional Antivirus fails to protect 40 percent of users!

Conventional antivirus solutions are failing to protect users from attacks according to a  Malwarebytes report.

The study is based on real-world clean up scans performed by Malwarebytes. Nearly 40 percent (39.18percent) of all malware attacks cleaned on endpoints with an AV installed occurred on endpoints that had two or more traditional AV solutions registered.

In addition 39.16 percent of attacks on endpoints with a non-OS bundled AV installed occurred on an endpoint running one of the four leading traditional AV solutions.

"The results of these scans clearly indicate the ineffectiveness of today's traditional AV solutions and, more importantly, the unknown risks to users that depend only on these AV platforms to stay safe," says Marcin Kleczynski, CEO of Malwarebytes. "Antiquated AV technology is no longer enough to protect from sophisticated cyberthreats. It's crucial that consumers and businesses understand this now before they become a victim of the next attack."

The findings also show the top ransomware types detected on compromised machines are Hidden Tear (41.65 percent) and Cerber (18.26 percent). Botnets most often detected include IRCBot (61.56 percent) and Kelihos (26.95 percent). The most prevalent Trojan types bypassing traditional AV detections are Fileless (17.76 percent) and DNSChangermalware (17.51 percent).

Of ransomware attacks 48.59 percent of Hidden Tear and 26.78 percent of Cerber events were found on a compromised endpoint that had at least one of the four leading traditional AV brands installed.

To show how widespread the problem is, Malwarebytes has produced a real-time heatmap that shows each time Malwarebytes remediates instances of malware on endpoints that have a traditional AV registered. It also shows the numbers of attacks missed by leading antivirus programs.

Source: betanews.com