Progressive Web App Office Software Coming To Windows 10

Microsoft has recently announced a new addition, coming soon to the Microsoft Store.  A free Office progressive web app (PWA), which is slated to replace the My Office app that comes pre-installed on Windows devices. The new app is functionally similar to the Office App you’re currently using, but it brings some exciting new features into play that users and IT managers alike will love.

In addition to being a central window giving you a birds’ eye view of your recent documents, contacts, and various Office files (Word, Excel, PowerPoint, Outlook), it also serves as a bridge between working offline and working online with Windows 10.

Users will be able to access Office apps installed locally on their devices, as well as web apps. They will also have a view into locally stored files as well as files stored on the cloud, which in the Microsoft ecosystem, generally means SharePoint and OneDrive.

In addition to that, because it’s a Progressive Web App, it can work offline as well and be pinned to the taskbar, just as you can do with a native Windows App.  The only catch is that you’ll need to be running the 1803 version of Windows 10 (or later versions) to make use of the new capabilities.

Although individual users will no doubt find a lot to be excited about, the company’s own statements make it clear that they’ve designed it with IT managers specifically in mind. That is, given that it will allow managers to customize the Office app with company branding and allow users to access a variety of third-party apps through the lens of the Office app.

In tandem with this announcement, Aaron Gustafson (from the Microsoft Edge browser development team) also announced that the next version of Edge will be built around Chromium and will allow users to install PWA’s from the browser itself. That build brings Edge back to par with both Google Chrome and Mozilla’s Firefox.

These are all excellent moves, and we can’t wait to start playing with the new app.  Kudos to Microsoft.

Google Security Device Had A Microphone Nobody Knew About

Google has found itself in hot water for something they claim to be an honest mistake and oversight. Owners of the company’s popular Nest Guard (the centerpiece to their Nest Secure home alarm system) have recently discovered a microphone hidden in the guts of the device.  The microphone wasn’t mentioned in the product’s specification sheet, which has creeped out consumer groups around the country and the world.

Google claims that their intention from the beginning was to incorporate Google Assistant functionality into the design. This of course would necessitate the presence of a microphone, making their failure to mention it nothing more than an oversight. Unfortunately, consumer groups don’t seem to be finding that explanation convincing, which explains the push back the company is suddenly getting.

To be fair, Google Assistant functionality would be a superb addition to Nest Secure, but people should be aware of what precisely they’re getting when they open their wallets and buy a new product.  Especially given the fact that there have been a number of high-profile instances where data captured by microphones embedded in a variety of consumer products has already been mishandled and misused.

It ultimately doesn’t matter how many people would or wouldn’t have made the purchase had they known about the presence of the microphone.  The central issue is that they purchased a product without realizing it could be used to record them.

These days, privacy concerns are increasingly on everyone’s mind and with good reason.  Every day, what remains of our privacy seems increasingly under attack.  Innocent oversight or not, this was an unnecessary invasion of that privacy, and advocacy groups are justified in calling the company out for it.

If you don’t yet own a Nest Secure, but have been considering buying one, be aware.  There’s a microphone embedded in it.

New Malware Is Coming Through Messaging Apps

As if your stressed IT staff didn’t have enough to deal with, there’s a new threat to be on the lookout for.

Researchers at the antivirus company Avast have discovered a new strain of malware that can spread by way of Skype and Facebook Messenger spam messages. The malware, called “Rietspoof” is described as a multi-stage malware strain.

It was first discovered back in August of last year, and until recently, didn’t raise any eyebrows because it was seldom used. That has now changed.  There’s been a notable uptick in the number of instances of Rietspoof detected on the web.

As malware goes, Rietspoof by itself isn’t all that threatening.  Its goal is merely to infect as many devices as possible, serving as a bridge between an infected device and a command and control server that allows other strains of malware to be systematically injected onto infected systems.

Rietspoof accomplishes this goal by placing a shortcut (LNK file) in the Windows Startup Folder. This is one of the critical folders that Avast and other major antivirus programs monitor rigorously. However, Rietspoof has managed to slip through the cracks, bypassing security checks because it is signed with legitimate certificates.

The malware’s infection cycle consists of four discrete steps. Three of them are dedicated to establishing a Rietspoof beachhead on a target system, and the fourth is reserved for the downloading of more intrusive and destructive malware strains.

According to the research team that discovered it, since they first began tracking the malware, it has undergone a number of incremental changes. That lead them to the conclusion that Rietspoof is a work in progress and currently undergoing testing and further development.

Although it may have limited functionality now, that could very easily change as the hackers behind the code continue to modify it.  Be sure your IT staff is aware, and stay vigilant!

 

Malware Stealing Usernames And Passwords At Alarming Rates

Much discussion has been had about the fact that hackers are becoming increasingly sophisticated, and their methods ever-increasing in their complexity.  While that’s certainly true, more complex isn’t always better.

Take, for example, the malware called Separ, which is a credential-siphoning bit of code, first detected in late 2017.

Separ has benefitted from ongoing development by the hackers controlling it, but what sets it apart from other malware strains is that it’s almost deceptively simple, and that simplicity is a big part of its success.

The program is surprisingly good at evading detection, thanks to clever use of a combination of short scripts and legitimate executable files that are commonly used for completely benign purposes. This allows them to blend in and be utterly overlooked by most detection routines.

The most recent iteration of the software is embedded in a PDF.  When an unsuspecting user clicks to open the file, Separ runs a chain of other apps and file types commonly used by System Admins.  The initial double click runs a simple Visual Basic Script (VBS), which in turn, executes a batch script.

The batch script sets up several directories and copies files to them. Then it launches a second batch script, which opens a decoy image to high command windows, lowers firewall protections, and saves the changes to an ‘ipconfig’ file.

Then, it gets down to its real work, again, relying on completely legitimate executables to collect passwords and move them to the hackers’ command and control server.

According to Guy Propper, (the team lead of Deep Instinct’s Threat Intelligence group):

“Although the attack mechanism used by this malware is very simple, and no attempt has been made by the attacker to evade analysis, the growth in the number of victims claimed by this malware shows that simple attacks can be very effective. The use of scripts and legitimate binaries, in a ‘living off the land’ scenario, means the attacker successfully evades detection, despite the simplicity of the attack.”

Be sure your IT staff aware.  It’s not always the most complex forms of malware that can get you.

Apple Developers Will Make Apps Usable On All Devices

Apple recently announced an important strategic change in direction that’s great news for developers.  In their next SDK release, developers will be able to build a single app that will work on every iPhone, iPad, and Mac the company makes.

The benefits to developers are obvious, with the biggest being a general reduction of development time.

There will be no need to make three different variants of an app to cover the entire Apple ecosystem.  It will also mean more potential customers if a development group has been focused on only one segment of that ecosystem.

The change will also give Apple a powerful advantage in that eventually, the company will be able to merge the Mac App Store and the App Store for iOS. That will reduce their digital footprint and make managing their vast holdings easier. In addition to that, it will streamline the approval process, allowing developers to submit a single binary for all Apple devices.

According to a statement recently published by the company, the new development kit could be pushed out by as early as June, which is generating a tremendous amount of excitement in the Apple development community.

Obviously, consumers will see a big win here as well.  Once the changes are complete and the two app stores are merged, there will be a single official hub where Apple users can get all their favorite Apps. They won’t even have to worry about cross-device compatibility, which will improve the overall user experience.

The bottom line is that it will make things easier for developers, make managing the process easier for Apple, simplify things, and improve the user experience for the legions of end users in Apple’s ecosystem. Kudos to the company for making the move.  Exciting changes are ahead!