Some HP Laptops Being Recalled For Battery Fire Risk

The US Consumer Product Safety Commission (USCPSC) has recently issued a statement concerning HP’s recall of more than 78,000 laptop batteries.  This is being issued in addition to the 50,000 laptop batteries the company recalled in January 2018 for the same issue. According to the company, the batteries in question are prone to overheating and pose fire and burn hazards.

The USCPSC’s statement comes on the heels of eight new reports of overheating battery packs.  Note that the actual recall announcement occurred back in January of this year.  The reason it’s only now getting press is because of the recent government shutdown.

If you personally own HP equipment, or if you’ve purchased some for company use, be sure to head to HP’s website for a full listing of the models that have been impacted by the recall.

In terms of scope and scale, this is hardly the biggest equipment recall we’ve seen in recent times.  Last year, Panasonic’s entire “Toughbook” product line had to be recalled, just to cite one example.

This isn’t the first time HP has had hardware problems in the recent past and it certainly won’t be the last. However, from what we can tell, this incident isn’t the leading edge of some type of systemic issue for the company.  It’s unfortunate, yes, but on its own we don’t see any reason to consider switching to some other hardware vendor.  After all, just about every major PC manufacturer has suffered similar issues at some point.

Even so, make sure the people in your employ who are using HP laptops are aware of the potential problem. Again, be sure to head to the company’s website to see if your equipment is at risk or not.

 

Pixel Phones Have The Update For Newest Android OS

The latest version of the Android OS is now available in beta form.  The catch is, you’ve got to own a Google Pixel phone to use it at this point. The rest of Google’s massive user base will get to see Android Q later this year. In an unusual move, the company limited access to their latest work in progress to Pixel owners, including those still using the Pixel 1 (which is technically no longer supported by the company).

The latest version of the OS introduces a variety of advancements.

Here are a few you’ll be impressed with:

  • Better split-screen support – Note that this also specifically improves enhanced support for foldable screens, which appear to figure heavily in Google’s long-term plans. That’s good news for some phone manufacturers.  If you own a Galaxy Fold, for example, when Q is released for your device, the change will have a big impact.
  • Improved Privacy and Permission Features – Any time you see a popup driven by an app seeking permission to access a portion of your data (location data, for example), you’ll see three options:
    • Allow All The Time
    • Allow Only While The App Is In Use
    • Deny
  • Improved Security – On the privacy front, Android Q does not allow apps to launch any activity while in the background, which means that malicious apps can’t do anything nefarious without user input.
  • Big Improvements To The Share Menu – One of the most persistent user complaints about previous versions of Android has been the OS’s sub-par share menu. It’s getting a major overhaul that makes it more intuitive and includes an option for developers to publish “Sharing Shortcuts” which should make the menu even more useful.

Do you own a Pixel?  If so, check out the new features and start playing around with them today!

Creator Of Popular Kids App Fined For Privacy Violations

The Federal Trade Commission just issued an enormous fine to a Chinese app developer for illegally collecting the personal data of the children who used it.

The company was handed a staggering $5.7 million fine when the FTC filed a complaint alleging that the video-sharing app was in violation of the Children’s Online Privacy Protection Act.

Their mistake was that the app did not require parental consent from users under the age of 13 before collecting personal information. As with many apps of this type, this one (called Tik Tok) collected vast amounts of information. This included user names, email addresses, first and last names, phone numbers, profile pictures, user-entered biographical information, location data, and more.

In addition to the obvious COPPA violations, the app’s development team came under fire when it was discovered that much of each user’s account information remained visible to the general public, even if the user opted to make their profile private.

Worst of all, in the FTC filing, it was noted that adults had made numerous attempts to contact children via the app. It also stated that until the company released an update in 2016, there was a feature in place that allowed a user to view all other signed-in users within a fifty-mile radius of their location.

The general state of app security and permissions is quite poor, but even given the relatively low standards in today’s market, the Tik Tok app sets new lows on several different fronts.  The hefty fine levied by the FTC was not only wholly justified, but it is hoped, will serve as a warning shot across the bow of app developers to start cleaning up their collective acts a bit, especially when marketing apps to children.

John Fokker, the head of Cyber Investigations at McAfee applauded the ruling, but also cautioned:

“…the responsibility also lies with parents to ensure their children are only signing up for services they’re old enough and wise enough to use.”

Wise words indeed, and kudos to the FTC.

Thunderbolt Vulnerability Could Allow Hackers Access

A new vulnerability was revealed to the world at the 2019 NDSS security conference. It’s a grim one with the potential to impact FreeBSD, Linux, Windows and Mac systems worldwide.

Dubbed ‘Thunderclap,’ the flaw can be exploited to impact the way that Thunderbolt-based peripherals connect and interact with a target system.

If you’re not familiar with Thunderbolt, it’s a hardware interface jointly designed by Intel and Apple that allows users to connect peripherals like chargers, keyboards, video projectors (and the like) to computers.  The interface was originally available only in the Apple ecosystem, but subsequent generations of Thunderbolt expanded its reach.  These days, Thunderbolt has hooks in every major OS in use today.

At a high level, Thunderclap is nothing more than a union of various security flaws found in the interface.  The main flaw stems from the fact that OS’s tend to implicitly trust any newly connected device, granting it access to all system memory.  A hacker attacking a system using this exploit can even bypass a system’s IOMMU (Input-Output Memory Management Unit), which is specifically designed to counter such threats.

Research conducted jointly at the University of Cambridge, SRI International, and Rice University discovered Thunderclap in late 2016. They have been quietly sounding the alarm since.  Unfortunately, the companies that design and sell operating systems have been slow to act, in a classic case of passing the buck.  The most common reason for failing to act is that the OS vendors say the responsibility lies on the peripheral side and vice versa.

The issue is finally getting the attention it deserves, but to date, none of the OS development companies have published a timeframe for when they’ll be issuing a patch to cover the security flaw.  Until that happens, the best thing you can do is to disable Thunderbolt ports via your system’s BIOS.

Social Media Is Big Business For Criminals

The rise of Social Media has been a game changer for businesses around the world, creating opportunities for customer engagement that were previously unimaginable.  Unfortunately, business owners aren’t the only ones reaping the benefits of Social Media.  The hackers of the world are in on the game too, and for them, Social Media represents a giant piggy bank that they’ve only begun tapping into.

Even now in the early stages of cybercriminal attacks on Social Media, the payoffs have been enormous. Social media attacks have been netting them a staggering $3.25 billion dollars a year.  As shocking as that figure might be, it’s important to remember that cybercrime on Social Media is a relatively new phenomenon.  Between 2013 and now, the number of cybercrime incidents involving social media has quadrupled.

The attacks take many forms, but one way or another, they come down to abusing the trust that is so essential for a functioning Social Media ecosystem.

Some attackers set up scam pages hawking illegal pharmaceuticals. Others gravitate toward cryptomining malware, while others still ply the Social Media waters intent on committing digital currency fraud or feigning a romantic connection to get money and personal information from their victims. Even if you’re one of the rare companies that doesn’t have a significant Social Media presence yet, that doesn’t mean you’re safe from harm.

Gregory Webb, the CEO of Bromium, recently spoke on the topic, outlining a danger that many business owners are simply unaware of.

“Social Media platforms have become near ubiquitous, and most corporate employees access Social Media sites at work, which exposes significant risk of attack to businesses, local governments as well as individuals.  Hackers are using social media as a Trojan horse, targeting employees to gain a convenient backdoor to the enterprise’s high value assets.”

In light of this, it’s probably well past time to sit down with your employees and make sure they’re aware of the risks they’re exposing you to when they access Social Media accounts at work.