Craig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity

Craig is on the WGAN Morning News with Ken and Matt. They talked about the Y2K-like bug that would strike GPS systems on April 6th, the hackable smart alarms, and Craig's stern warning to ditch Windows 7 and upgrade to Windows 10.

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles:

'Gps Systems Will Be Struck By Y2k-Like Bug On April 6': Security Expert Says He Will Not Fly On 'Day Zero' After Governments Warn Global Devices Will Reset Due To Calendar Glitch

Google Recommends Windows 7 Users To Upgrade To Windows 10 If Possible, As A Kernel Vulnerability Allows For Local Privilege Escalation On The Operating System.

No Guns Or Lockpicks Needed To Steal Modern Cars If They're Fitted With Hackable 'Smart' Alarms
---

Transcript:

Below is a rush transcript of this segment, it might contain errors.

Airing date: 03/20/2019

Dangers Of Smart Remotes - GPS Y2K

Craig Peterson  0:00
Hey, good morning, everybody. Craig Peterson here again. And I was on this morning being Wednesday with three stations up in Maine, up in Maine's capital city, as well, and I was on with Ken and Matt. We chatted about a few different things. I ask them some questions about demonetizing deplatforming. What are the legal requirements there? And it was kind of interesting because of course Ken is an attorney to find out what's going on. The mom in Arizona with the kids on YouTube. Boy, what a mess that is. We've got representative Nunez who is threatening suit due to something very similar and we've seen this happen a lot so where is this line supposed to be drawn? Kind of interesting we also of course talked a little bit about technology and Matt's problem where Matt had his fob reprogrammed for his car and tied right in to a story this week about the smart alarms and how imminently hackable they are. So here we go.

Matt Gagnon1:09
Alright, we are back again on 7:37 on the WGAN Morning News. Wednesday morning and get a matter here. And so is Craig Peterson, our tech guru. He joins us now. Craig, how are you?

Craig 1:22
Hello. I'm doing well. I am I'm really interested in what's happened here. You guys have been reporting on this case of the Arizona mother who was abusing their children. And we also have I'm trying to remember who this was, someone in Congress just threatened suit or bringing suit against I think it's Twitter.

Matt 1:48
Yeah. You were thinking about Mr. Nunez.

Craig 1:48
Yeah, yeah. Exactly.

Ken Altshuler  1:51
That's what you call a publicity stunt.

Matt  1:52
Yes. He's gonna fail miserably.

Craig 1:53
You think so? You think that's what it is?

Ken 1:54
Of course. Of course.

Matt 1:55
Because he knows he's gonna lose. So what else would it be?

Ken  1:51
Public figure.

Craig 1:56
Yeah. Well that's a really good point. How about we've got the Hallmark Channel cutting ties with Laurie we know this whole college admissions scandal and stuff. How far can that go ultimately? Because, again, they've got clauses in their contracts on saying that they have to be a good character,

Ken 2:21
By the way, I pay nearly half a million dollars for my children to go to college, I don't see what the big deal is.

Craig 2:28
In Arizona again, obviously, this woman what she's charged with is just absolutely crazy. But can we have all of these social media platforms and other ways that people are making money and trying to get messages out? Can people be deplatformed at the drop of a hat? And should they be? It's an interesting question. I don't know how far this goes. I've heard Nunez and and his complaints. And I've heard other people, particularly conservatives saying that their messages are being stopped or they've been deplatformed. And we've certainly seen that with Alex Jones and some others who Alex isn't accused of anything illegal. It just being a real jerk, I think is is kind of the bottom line for him. But is it again, interesting territory? I don't know. Ken, had the courts really settled any of this stuff yet?

Ken 3:20
I think it's basic libel and slander law. I think if you're a public figure it's virtually impossible to be...

Matt 3:22
But as it relates to like deplatforming and stuff like that, that's
their company, they can do whatever they want with it. I mean, it's if they want to, they want to ban me for having brown hair or blue eyes. I mean, they could do that. Whenever. And perhaps it's not the wisest thing for them to do. And I think it opens a gigantic door for a competitor that isn't such a, you know, terrible company to actually operate. But you know, they want to do that they could do that.

Craig 3:51
Yeah, yeah, I agree on that part. That's certainly the libertarian to me coming out for that. Anyhow, it was interesting, I thought I would ask the experts this morning.

Ken 4:00
Well, talking about experts, since you're the expert guru in computers, are we going to have another Y2K thingamajiggy?

Craig 4:09
Oh, this this is really weird. This one that hit me a few weeks ago and hit my inbox as it were. And Y2K of course, we have a problem with the rollover from a computer is able to use just a two digit year to figure out the time and elapsed time, you know, where they were just use, like 74, I wrote code that just choose the last two digits of the year back in the you know, in the 70s and and it's been going on for a long time. So everyone was worried what's going to happen when it turns from being able to issues 99 to zero, because they're always lower than 99. But it turns out most businesses had fixed the problems and none of these problems were were anything that would have been really earth shattering if they had to get at least not in most cases. Now we've got a security expert who about two weeks ago out at a security conference in San Francisco said that he's not going to fly on April 6 and the reason for that is that older GPS systems don't have the ability to handle dates past April 6 it's actually a specific time on April 6. But here's the problem the counters in the old GPS systems don't have enough digit so they are going to roll back to zero. And we look at what's happening right now with Boeing's jet, the 737 Max 8 right and that jet airliner. How long ago was that designed? Do you guys know?

Matt  5:57
The 737?

Craig 6:00
What is it? Is that it? Yeah, the Max 8.

Matt 6:01
Yes, Max. Yeah, the 737 Max. I have no idea what it is. No, I can't even begin to claim that I have any idea

Craig 6:07
Such a 50 year old design and what's been happening over the years is they've been making a minor changes kind of, you know, few changes of the time. So the whole jet airliner has not had to be retested. So for instance, right now they added this system that people are saying like be the problem could be the problem. Boeing saying it's more along the lines of the pilots weren't trained enough, they only had a few hundred hours of flight time. But inside these airplanes are systems that were designed 50 years ago. And so this expert is saying, Hey, listen, this could be a real problem because the GPSs from 20 years ago, cannot handle the rollover the guy's name is Bill Malik. He's a VP over Trend Micro which is a basically a security company and he's concerned because these GPS systems aren't just to use in things like airports and airplanes although I'm sure in pretty much every case the airplane have been updated, right? I'm I don't have a problem with flying on April 6 personally. But we also have these embedded systems that are used for their clock source for that signal. And they're using everything from traffic control systems through a computer systems. Some of the older ones, the bridges, some of the automatic bridges that we have in Maine, like one going down to New Hampshire that that goes up and down based on what the traffic is on the on the water below. A lot of these systems are based on using clocks from GPSs. So Ken we could have a Y2K type problem with anything with an older embedded GPS in them on April 6. And it does bring up the problem of, again, updating our software, our firmware, our hardware, you know, when was the last time you updated the software in your firewall in the router in your home. This statistics on the more or horrific. People just aren't updating them. So it brings it to light. And yeah, GPS could be a problem. And you might even have it with your car GPS, if you have an old GPS for your car. It might just plain old completely stopped working on April 6.

Matt 8:38
And we're talking to Craig Peterson, our tech guru joins who us on Wednesdays at this time to go over what's happening in the world of technology. Craig, I had a little bit of a car issue a while back a couple weeks ago had to get somebody to basically break into my car and reprogram a fob which he was able to do by basically plugging in a little computer to my car. And about 30 seconds later, he had now taken over the entire security system and it was able to start it remotely and basically we had complete and total control over the car by plugging something in. Is my car a little vulnerable to being taken over by surreptitious evil people trying to steal it in some fashion, or maybe perhaps taking it over for other nefarious purposes?

Craig 9:25
You know what kind of car I drive, right?

Matt 9:29
Yeah, like an old one. Yeah.

Craig 9:30
1980 Mercedes diesel okay. There is missing electronics on it. Yeah, actually, you are. And it's yet another reason to lock your car. Because if they get can gain access to that little computer port inside, many of the cars can be totally hacked. Now, the manufacturers are trying to keep that technology kind of secret. But man is it gotten out and it's in the hands of even people that change locks, you know, the fob you talked about. But we've got this week as a British firm. They're called Pentest Partners. And they had heard about some vulnerabilities with some of the smart alarms that people have been putting in their cars. So they did some testing. And they've come out with a warning and they're warning is that they found that the Viper Smart Start alarm Viper Smart Start alarm, which I'm sure many people here have in their cars get is great to start your car get warmed up in the wintertime and get into a nice warm car. But the Viper Smart Alarms as well as product from Pandora where they're making, not Pandora, the radio app that you might be using, but Pandora, the guys that make the smart alarms. Both of them are riddled with flaws. According to the report. That's a direct quote from them. And it turns out that the manufacturers had inadvertently exposed around 3 million cars to theft and users to hijack. Because what they can do is without even having access to that computer port in the car, they're able to get on remotely and do anything that that smart alarm could do and do it to your car. And it turns out even more than you think the smart alarm might be able to do just like with your car Matt where he could get in and do a whole bunch of different things inside your car. These can too and they found they could remotely hack the car that they could then from that car not only unlock it or start the engine but if you're driving down the highway in that car, they could control the accelerator so they could take you for ransom, floor the car have that car going full speed down the turnpike as fast as it could possibly go with you sitting behind the wheel unable to do anything about it you know. Burn outs, your brakes, etc. So there they did a live proof of concept demo, they could do geo-locate the target car using the Viper Smart Start account. Built in functionality. They set off the alarm so that the driver went out to investigate and stopped, activated the cars and mobilizer once it was stationary, remotely unlock the cars doors. They clone the key fob. They issued RS commands from a user's mobile phone. And even worse, they discovered this function in the Viper API that remotely turned off the cars engine. There, these devices can do a whole lot. So check your smart alarm, your smart remote start, see if it's vulnerable, what the vulnerabilities are not all of the vulnerabilities I mentioned are true for both of these alarms. But they have been shown in the past. We've seen Chrysler's be able to be taken over. Remotely driven off the road. But the hacker had to have access to the car first. Now we're seeing that some of these smart alarms have way more access than we thought they did. And could turn out to be very, very dangerous.

Ken 13:15
We are talking to Craig Peterson, our tech guru. By the way you can go to https://CraigPeterson.com anytime you want to know anything about technology. Thank you, Mr. Peterson. We'll talk to you on next Wednesday at 7:38.

Craig 13:27
Hey, take care. Gentlemen, I want to make one quick warning. Before I go. Google has now issued a warning to everyone to abandon Windows 7 right now. They say there's a major security problem with Windows 7 there. Google is advising you to upgrade to Windows 10. And this is a kernel vulnerability problem. Local privilege escalation something.

Ken 13:55
I think I have Windows 7.

Matt 13:57
I think I have Mac.

Ken 13:58
But I have Windows on my Mac.

Matt 14:00
That's old.

Craig 14:00
Well, it's true for that too. So if you're still running Windows 7, if this isn't the siren call to upgrade, quote unquote, to Windows 10 do it now. But you might be better off and upgrade to a Mac. That's what I did.

Ken 14:14 
Yeah. But I have a Mac but have Windows on it.

Craig 14:16
Yeah, but you're still gonna have to do it. You're gonna have to upgrade your Windows on your Mac that's living in the VM or the dual boot loader

Ken 14:23
That's living in VM. That's where it's living.

Craig 14:26
Yeah. Which is good that helps keep it separate but you're gonna have to upgrade it. This is bad, this is really bad.

Ken 14:33
Okay, thanks for the warning. 

Matt 14:35
Craig Peterson. Thanks a lot. Alright, we are going to take a quick break here are we not?

Craig 14:41
Hey everybody. Plan is to be here  tomorrow and Friday as well with my security thing, you know, it's just a security thing. Well, how does it matter, right? So hopefully I'll be able to get those done today and we'll get those out. But it's stories of individuals and companies who have been hacked or who averted a hack, what happened? What they did? And what could have been done better about it?. So if you're enjoying those let me know. [email protected].

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Craig is on the WGAN Morning News with Ken and Matt. They talked about the Y2K-like bug that would strike GPS systems on April 6th, the hackable smart alarms, and Craig's stern warning to ditch Windows 7 and upgrade to Windows 10.

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles:

'Gps Systems Will Be Struck By Y2k-Like Bug On April 6': Security Expert Says He Will Not Fly On 'Day Zero' After Governments Warn Global Devices Will Reset Due To Calendar Glitch

Google Recommends Windows 7 Users To Upgrade To Windows 10 If Possible, As A Kernel Vulnerability Allows For Local Privilege Escalation On The Operating System.

No Guns Or Lockpicks Needed To Steal Modern Cars If They're Fitted With Hackable 'Smart' Alarms
---

Transcript:

Below is a rush transcript of this segment, it might contain errors.

Airing date: 03/20/2019

Dangers Of Smart Remotes - GPS Y2K

Craig Peterson  0:00
Hey, good morning, everybody. Craig Peterson here again. And I was on this morning being Wednesday with three stations up in Maine, up in Maine's capital city, as well, and I was on with Ken and Matt. We chatted about a few different things. I ask them some questions about demonetizing deplatforming. What are the legal requirements there? And it was kind of interesting because of course Ken is an attorney to find out what's going on. The mom in Arizona with the kids on YouTube. Boy, what a mess that is. We've got representative Nunez who is threatening suit due to something very similar and we've seen this happen a lot so where is this line supposed to be drawn? Kind of interesting we also of course talked a little bit about technology and Matt's problem where Matt had his fob reprogrammed for his car and tied right in to a story this week about the smart alarms and how imminently hackable they are. So here we go.

Matt Gagnon1:09
Alright, we are back again on 7:37 on the WGAN Morning News. Wednesday morning and get a matter here. And so is Craig Peterson, our tech guru. He joins us now. Craig, how are you?

Craig 1:22
Hello. I'm doing well. I am I'm really interested in what's happened here. You guys have been reporting on this case of the Arizona mother who was abusing their children. And we also have I'm trying to remember who this was, someone in Congress just threatened suit or bringing suit against I think it's Twitter.

Matt 1:48
Yeah. You were thinking about Mr. Nunez.

Craig 1:48
Yeah, yeah. Exactly.

Ken Altshuler  1:51
That's what you call a publicity stunt.

Matt  1:52
Yes. He's gonna fail miserably.

Craig 1:53
You think so? You think that's what it is?

Ken 1:54
Of course. Of course.

Matt 1:55
Because he knows he's gonna lose. So what else would it be?

Ken  1:51
Public figure.

Craig 1:56
Yeah. Well that's a really good point. How about we've got the Hallmark Channel cutting ties with Laurie we know this whole college admissions scandal and stuff. How far can that go ultimately? Because, again, they've got clauses in their contracts on saying that they have to be a good character,

Ken 2:21
By the way, I pay nearly half a million dollars for my children to go to college, I don't see what the big deal is.

Craig 2:28
In Arizona again, obviously, this woman what she's charged with is just absolutely crazy. But can we have all of these social media platforms and other ways that people are making money and trying to get messages out? Can people be deplatformed at the drop of a hat? And should they be? It's an interesting question. I don't know how far this goes. I've heard Nunez and and his complaints. And I've heard other people, particularly conservatives saying that their messages are being stopped or they've been deplatformed. And we've certainly seen that with Alex Jones and some others who Alex isn't accused of anything illegal. It just being a real jerk, I think is is kind of the bottom line for him. But is it again, interesting territory? I don't know. Ken, had the courts really settled any of this stuff yet?

Ken 3:20
I think it's basic libel and slander law. I think if you're a public figure it's virtually impossible to be...

Matt 3:22
But as it relates to like deplatforming and stuff like that, that's
their company, they can do whatever they want with it. I mean, it's if they want to, they want to ban me for having brown hair or blue eyes. I mean, they could do that. Whenever. And perhaps it's not the wisest thing for them to do. And I think it opens a gigantic door for a competitor that isn't such a, you know, terrible company to actually operate. But you know, they want to do that they could do that.

Craig 3:51
Yeah, yeah, I agree on that part. That's certainly the libertarian to me coming out for that. Anyhow, it was interesting, I thought I would ask the experts this morning.

Ken 4:00
Well, talking about experts, since you're the expert guru in computers, are we going to have another Y2K thingamajiggy?

Craig 4:09
Oh, this this is really weird. This one that hit me a few weeks ago and hit my inbox as it were. And Y2K of course, we have a problem with the rollover from a computer is able to use just a two digit year to figure out the time and elapsed time, you know, where they were just use, like 74, I wrote code that just choose the last two digits of the year back in the you know, in the 70s and and it's been going on for a long time. So everyone was worried what's going to happen when it turns from being able to issues 99 to zero, because they're always lower than 99. But it turns out most businesses had fixed the problems and none of these problems were were anything that would have been really earth shattering if they had to get at least not in most cases. Now we've got a security expert who about two weeks ago out at a security conference in San Francisco said that he's not going to fly on April 6 and the reason for that is that older GPS systems don't have the ability to handle dates past April 6 it's actually a specific time on April 6. But here's the problem the counters in the old GPS systems don't have enough digit so they are going to roll back to zero. And we look at what's happening right now with Boeing's jet, the 737 Max 8 right and that jet airliner. How long ago was that designed? Do you guys know?

Matt  5:57
The 737?

Craig 6:00
What is it? Is that it? Yeah, the Max 8.

Matt 6:01
Yes, Max. Yeah, the 737 Max. I have no idea what it is. No, I can't even begin to claim that I have any idea

Craig 6:07
Such a 50 year old design and what's been happening over the years is they've been making a minor changes kind of, you know, few changes of the time. So the whole jet airliner has not had to be retested. So for instance, right now they added this system that people are saying like be the problem could be the problem. Boeing saying it's more along the lines of the pilots weren't trained enough, they only had a few hundred hours of flight time. But inside these airplanes are systems that were designed 50 years ago. And so this expert is saying, Hey, listen, this could be a real problem because the GPSs from 20 years ago, cannot handle the rollover the guy's name is Bill Malik. He's a VP over Trend Micro which is a basically a security company and he's concerned because these GPS systems aren't just to use in things like airports and airplanes although I'm sure in pretty much every case the airplane have been updated, right? I'm I don't have a problem with flying on April 6 personally. But we also have these embedded systems that are used for their clock source for that signal. And they're using everything from traffic control systems through a computer systems. Some of the older ones, the bridges, some of the automatic bridges that we have in Maine, like one going down to New Hampshire that that goes up and down based on what the traffic is on the on the water below. A lot of these systems are based on using clocks from GPSs. So Ken we could have a Y2K type problem with anything with an older embedded GPS in them on April 6. And it does bring up the problem of, again, updating our software, our firmware, our hardware, you know, when was the last time you updated the software in your firewall in the router in your home. This statistics on the more or horrific. People just aren't updating them. So it brings it to light. And yeah, GPS could be a problem. And you might even have it with your car GPS, if you have an old GPS for your car. It might just plain old completely stopped working on April 6.

Matt 8:38
And we're talking to Craig Peterson, our tech guru joins who us on Wednesdays at this time to go over what's happening in the world of technology. Craig, I had a little bit of a car issue a while back a couple weeks ago had to get somebody to basically break into my car and reprogram a fob which he was able to do by basically plugging in a little computer to my car. And about 30 seconds later, he had now taken over the entire security system and it was able to start it remotely and basically we had complete and total control over the car by plugging something in. Is my car a little vulnerable to being taken over by surreptitious evil people trying to steal it in some fashion, or maybe perhaps taking it over for other nefarious purposes?

Craig 9:25
You know what kind of car I drive, right?

Matt 9:29
Yeah, like an old one. Yeah.

Craig 9:30
1980 Mercedes diesel okay. There is missing electronics on it. Yeah, actually, you are. And it's yet another reason to lock your car. Because if they get can gain access to that little computer port inside, many of the cars can be totally hacked. Now, the manufacturers are trying to keep that technology kind of secret. But man is it gotten out and it's in the hands of even people that change locks, you know, the fob you talked about. But we've got this week as a British firm. They're called Pentest Partners. And they had heard about some vulnerabilities with some of the smart alarms that people have been putting in their cars. So they did some testing. And they've come out with a warning and they're warning is that they found that the Viper Smart Start alarm Viper Smart Start alarm, which I'm sure many people here have in their cars get is great to start your car get warmed up in the wintertime and get into a nice warm car. But the Viper Smart Alarms as well as product from Pandora where they're making, not Pandora, the radio app that you might be using, but Pandora, the guys that make the smart alarms. Both of them are riddled with flaws. According to the report. That's a direct quote from them. And it turns out that the manufacturers had inadvertently exposed around 3 million cars to theft and users to hijack. Because what they can do is without even having access to that computer port in the car, they're able to get on remotely and do anything that that smart alarm could do and do it to your car. And it turns out even more than you think the smart alarm might be able to do just like with your car Matt where he could get in and do a whole bunch of different things inside your car. These can too and they found they could remotely hack the car that they could then from that car not only unlock it or start the engine but if you're driving down the highway in that car, they could control the accelerator so they could take you for ransom, floor the car have that car going full speed down the turnpike as fast as it could possibly go with you sitting behind the wheel unable to do anything about it you know. Burn outs, your brakes, etc. So there they did a live proof of concept demo, they could do geo-locate the target car using the Viper Smart Start account. Built in functionality. They set off the alarm so that the driver went out to investigate and stopped, activated the cars and mobilizer once it was stationary, remotely unlock the cars doors. They clone the key fob. They issued RS commands from a user's mobile phone. And even worse, they discovered this function in the Viper API that remotely turned off the cars engine. There, these devices can do a whole lot. So check your smart alarm, your smart remote start, see if it's vulnerable, what the vulnerabilities are not all of the vulnerabilities I mentioned are true for both of these alarms. But they have been shown in the past. We've seen Chrysler's be able to be taken over. Remotely driven off the road. But the hacker had to have access to the car first. Now we're seeing that some of these smart alarms have way more access than we thought they did. And could turn out to be very, very dangerous.

Ken 13:15
We are talking to Craig Peterson, our tech guru. By the way you can go to https://CraigPeterson.com anytime you want to know anything about technology. Thank you, Mr. Peterson. We'll talk to you on next Wednesday at 7:38.

Craig 13:27
Hey, take care. Gentlemen, I want to make one quick warning. Before I go. Google has now issued a warning to everyone to abandon Windows 7 right now. They say there's a major security problem with Windows 7 there. Google is advising you to upgrade to Windows 10. And this is a kernel vulnerability problem. Local privilege escalation something.

Ken 13:55
I think I have Windows 7.

Matt 13:57
I think I have Mac.

Ken 13:58
But I have Windows on my Mac.

Matt 14:00
That's old.

Craig 14:00
Well, it's true for that too. So if you're still running Windows 7, if this isn't the siren call to upgrade, quote unquote, to Windows 10 do it now. But you might be better off and upgrade to a Mac. That's what I did.

Ken 14:14 
Yeah. But I have a Mac but have Windows on it.

Craig 14:16
Yeah, but you're still gonna have to do it. You're gonna have to upgrade your Windows on your Mac that's living in the VM or the dual boot loader

Ken 14:23
That's living in VM. That's where it's living.

Craig 14:26
Yeah. Which is good that helps keep it separate but you're gonna have to upgrade it. This is bad, this is really bad.

Ken 14:33
Okay, thanks for the warning. 

Matt 14:35
Craig Peterson. Thanks a lot. Alright, we are going to take a quick break here are we not?

Craig 14:41
Hey everybody. Plan is to be here  tomorrow and Friday as well with my security thing, you know, it's just a security thing. Well, how does it matter, right? So hopefully I'll be able to get those done today and we'll get those out. But it's stories of individuals and companies who have been hacked or who averted a hack, what happened? What they did? And what could have been done better about it?. So if you're enjoying those let me know. [email protected].

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Craig is on with Danny Farrantino once more on the Jim Polito show. They talked about the GPS security flaw that is worse than the Y2K bug which could cause havoc in a lot of computer systems on April 6th. 

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles:

'Gps Systems Will Be Struck By Y2k-Like Bug On April 6': Security Expert Says He Will Not Fly On 'Day Zero' After Governments Warn Global Devices Will Reset Due To Calendar Glitch

Google Recommends Windows 7 Users To Upgrade To Windows 10 If Possible, As A Kernel Vulnerability Allows For Local Privilege Escalation On The Operating System.

No Guns Or Lockpicks Needed To Steal Modern Cars If They're Fitted With Hackable 'Smart' Alarms

--- 

Transcript:

Below is a rush transcript of this segment, it might contain errors.

Airing date: 03/19/2019

Major Problems With GPS - Car Security Systems Hackable

Craig Peterson: 0:00
Good morning. Craig Peterson here. I was on this morning with the Jim Polito show. It was actually Danny because Jim is on a tour. He is over touring in Italy. He was in Venice yesterday. And he's going on to Ireland. He sounds like he's just having a great time. So Danny and I chatted this morning, and I did some explanations here of GPS, what it is, how it works and how it's going to affect you. I think this is much better explanation than I did last time on the radio. Oh, well. Anyways, here we go with Mr. Danny Farrantino.

Danny Farrantino 0:35
Yes, by now. You know what that music means? Time for Tech Talk expert, Craig Peterson. And Craig. GPS systems are going to be struck by a Y2K bug. Come on, this can't be real.

Craig 0:48
Hey, good morning, Danny. Yeah, this is a real problem. And most people don't understand what's going on. And this is something I wasn't even aware of just a week and a half, two weeks ago, before I came across this. You know, we've been having these issues with the airplanes, right? And, and the Boeing jet that has been grounded pretty much worldwide. And the reason for that seems to be new software, some new systems and things on board. But you know, how long ago that base airplane was designed, Danny?

Danny 1:23
I do not, Craig, know. But I'm sure you do.

Craig 1:27
About 60 years old. 6 zero years old. Yeah. And what's been happening. And this is common for airplane manufacturers. But what's been happening is they make small changes to the airplane and they get it approved. So the whole plane doesn't have to be rechecked. And they eventually end up with a situation like today, where it's no longer the pharaohs boat, for those of you from law school, remember that story. But we will get into that right now. But the here's the problem we're looking at today. GPS has been around for many, many decades now. And of course, it works by having satellites up in the air above us and and in in space, and they send a signal down and our GPS units pick it up. Well, that signal is actually a primarily a clock signal.

Craig 2:25
Have you ever been ever heard something loud in the distance, like lightning? For instance, right?

Danny 2:31 
Yep.

Craig 2:31
And you see it before you hear it usually, right? What happens with lightning? If you see it and hear it at the same time? How far away is it?

Danny 2:42
Pretty, pretty damn close.

Craig 2:45
Exactly, you know, the closer it is between seeing it and hearing it, the closer that lightning is. So that's the same basic way that GPS works. All of these satellites are in orbit, they're all in a fixed spot. The software knows exactly where they are. So the satellite identifies itself, and then sends a high precision time code. So satellites that are further away the time code is going to be older than satellites that are closer to you, they're going to have a newer time code. So that's how GPS works. And sitting there listening to those times code and deciding, oh, that satellite is further away than that satellite. And it's so much further based on this real high precision time code. So there you go. There's a geek moment of the morning. But the problem that we're looking at right now is these older devices, including older airplanes, bridge control systems, systems that change traffic from one direction to another direction at a certain time of day, many of those relies heavily on GPS, not to position themselves necessarily, but to get an accurate time. So they will they want to know when 3pm is why not listen to those high precision atomic clock that are being broadcasted all over the world?

Danny 4:14  
We have one here.

Craig 4:16 
And you do exactly. Now I have one at my house, do we use them to synchronize all of our computers' clocks. Well, older GPS systems have an overflow problem. I know you mentioned earlier this morning Y2K. And we were very worried about Y2K, because many programmers like myself programming in the 70's and the 60's, we were too worried about whether or not 70 meant 2070 or 1970. We knew that 70 meant that our clock or our timestamp was really 1970. And so we had that two digit year, here comes 2000 that rolls over, there were some problems but it wasn't catastrophic. Well, how about all of these embedded systems, when was the last time you upgraded the firmware in your car?

Craig 5:09
When was the last time you updated the firmware in your firewall or your router. And hopefully, you do that pretty frequently. But I can tell you 99% of people never ever touched them. So about two weeks ago, in San Francisco, there was a conference, a security conference, and there was an expert out there saying that he will not fly, he will not get in an airplane on April 6. And the reason for that. And this by the ways of VP over at Trend Micro and Bill Malik is his name. And the reason is because the counters in the older GPS systems are going to overflow on April 6. It is going to reach the end of their counters are going to ramp back to zero.

Danny 5:57
So in theory the GPSs might not be set up properly. And you,yeah, I know, it makes sense why you might not want to fly that day.

Craig 6:03
Exactly. So there's more than him that just isn't going to fly that day. But this is a warning that was initially issued in April 2018. We have all of these older systems, and then some of them are guaranteed to have problems on April 6th. Hopefully, none of our airplanes do. But this could this could be real catastrophe. He's saying, now Trend Micro, they deal a lot with computer security systems. And, and, you know, maybe, maybe he's trying to get a little bit of news. But I know personally that the GPS systems that were made 20 years ago were very primitive. They're embedded in all kinds of devices. And the risk here is substantially greater than the risk we had with Y2K because the Y2K bug, there were very few systems that could, if they failed, cause people to die. These GPS systems that are embedded could cause people to die. And April 6 is the day. So fingers crossed, the manufacturers and owners of all these systems have taken care of it.

Danny 7:10
So that was my next question then. So here's the big question is what's being done to either prevent this, or we just waiting till April 6 and saying waiting to see what happens?

Craig 7:20
Well, there are a lot of companies that waited until January 1, 2000, to figure out if anything was going to happen. This time around. I think there's a lot of companies that aren't even aware, including government agencies that aren't even aware that there could be a problem. So there's certainly a lot of companies that have taken care of this already, some government agencies that have but if there is 20 year old hardware out there somewhere and think about military systems. And again, think about airplanes, 20 year old hardware, is it going to have this problem. Commercial airlines, I would expect to all of them have taken care of this problem. They've looked into it, these aren't idiots out there. But when it comes to some of these systems that are sitting in the back corner, just plugging away every day. That's where I'm getting really worried.

Craig 8:09
Well, that's it. You have that from Craig. Moving on though, I do want to hit a couple more topics before we have to let you go. The hackable smart alarms turns out, thieves may not even need a key or tools to steal your car from that one.

Craig 8:22
Yeah, this goes back again to so many businesses, just not being aware of the security implications of what they're doing. Car security alarm companies for years and decades. I remember buying these things in the 80's right and earlier, they were very simple. And if a switch was thrown, the alarm went off. Nowadays, they're putting APIs, application programming interfaces into their software, and just all kinds of smart technology. And we now have some penetration testing companies, including one over in the UK called Pentest Partners. They've been looking at these smart alarms after they heard about a problem. So they found that the Viper smart alarm and products from Pandora who makes alarms were riddled with all kinds of security flaws. And they found that they could steal a car fitted with any of these affected devices. They could steal them, they could shut off the engine and talking about wrecking havoc, they could cause the cars to go into full throttle mode while they're out on the road. Which means if you want to kill a lot of people and create a lot of havoc, sounds like it's simpler than we would hope.

Danny 9:42
There's a lot more than just stealing a car. It's taking complete control of that cars there, Craig.

Craig 9:48
Exactly. without doing anything, you know, we had the Chrysler problem where you could hack their entertainment system and take over the whole car, but you had to have physical access to that Chrysler car in order to do it. This doesn't require any physical access to the car. It can all be done remotely. 

Danny 10:09
It's certainly scary stuff Craig. Thank God, we have people like you keeping us safe. As always, we have so much stuff here. We never didn't get to somebody wants to hear more. What can they do?

Craig 10:18
Well, they can text me and I want to put one more quick warning in. Google's warning, everyone that's using Windows 7 to abandon it immediately. Windows 7. This is a warning out of Google and their security department. They say you need to upgrade to Windows 10 immediately. There is a huge security flaw with Windows 7. But you can text me 855-385-5553. That's 855-385-5553.

Danny 10:50
Standard data and messaging rates do apply. Craig, appreciate the time and we'll talk again next week.

Craig 10:55
Hey, thanks Danny. Take care.

Danny 10:56
As always. Craig Peterson there with some great stuff for us here on a Tuesday morning.

Craig 11:03
Hey, everybody. If you enjoy my podcast, make sure you let me know and subscribe. subscriptions is how we move up in the charts. That's how other people find us. So go to  http://CraigPeterson.com/iTunes. That'll take you directly to the 800 pound gorilla, which of course is Apple and you can subscribe right there. You can subscribe on almost anything frankly, I'm out there all over the place. And then once you subscribe. If you think I'm worth five stars, by all means, please put in a five star rating. I'd appreciate it. All right, everybody take care of we'll be back tomorrow from Maine.

---

Don't miss any episode from Craig. Visit http://CraigPeterson.com/itunes. Subscribe and give us a rating!

Thanks, everyone, for listening and sharing our podcasts. We're really hitting it out of the park. This will be a great year! 

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Craig is on with Danny Farrantino once more on the Jim Polito show. They talked about the GPS security flaw that is worse than the Y2K bug which could cause havoc in a lot of computer systems on April 6th. 

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles:

'Gps Systems Will Be Struck By Y2k-Like Bug On April 6': Security Expert Says He Will Not Fly On 'Day Zero' After Governments Warn Global Devices Will Reset Due To Calendar Glitch

Google Recommends Windows 7 Users To Upgrade To Windows 10 If Possible, As A Kernel Vulnerability Allows For Local Privilege Escalation On The Operating System.

No Guns Or Lockpicks Needed To Steal Modern Cars If They're Fitted With Hackable 'Smart' Alarms

--- 

Transcript:

Below is a rush transcript of this segment, it might contain errors.

Airing date: 03/19/2019

Major Problems With GPS - Car Security Systems Hackable

Craig Peterson: 0:00
Good morning. Craig Peterson here. I was on this morning with the Jim Polito show. It was actually Danny because Jim is on a tour. He is over touring in Italy. He was in Venice yesterday. And he's going on to Ireland. He sounds like he's just having a great time. So Danny and I chatted this morning, and I did some explanations here of GPS, what it is, how it works and how it's going to affect you. I think this is much better explanation than I did last time on the radio. Oh, well. Anyways, here we go with Mr. Danny Farrantino.

Danny Farrantino 0:35
Yes, by now. You know what that music means? Time for Tech Talk expert, Craig Peterson. And Craig. GPS systems are going to be struck by a Y2K bug. Come on, this can't be real.

Craig 0:48
Hey, good morning, Danny. Yeah, this is a real problem. And most people don't understand what's going on. And this is something I wasn't even aware of just a week and a half, two weeks ago, before I came across this. You know, we've been having these issues with the airplanes, right? And, and the Boeing jet that has been grounded pretty much worldwide. And the reason for that seems to be new software, some new systems and things on board. But you know, how long ago that base airplane was designed, Danny?

Danny 1:23
I do not, Craig, know. But I'm sure you do.

Craig 1:27
About 60 years old. 6 zero years old. Yeah. And what's been happening. And this is common for airplane manufacturers. But what's been happening is they make small changes to the airplane and they get it approved. So the whole plane doesn't have to be rechecked. And they eventually end up with a situation like today, where it's no longer the pharaohs boat, for those of you from law school, remember that story. But we will get into that right now. But the here's the problem we're looking at today. GPS has been around for many, many decades now. And of course, it works by having satellites up in the air above us and and in in space, and they send a signal down and our GPS units pick it up. Well, that signal is actually a primarily a clock signal.

Craig 2:25
Have you ever been ever heard something loud in the distance, like lightning? For instance, right?

Danny 2:31 
Yep.

Craig 2:31
And you see it before you hear it usually, right? What happens with lightning? If you see it and hear it at the same time? How far away is it?

Danny 2:42
Pretty, pretty damn close.

Craig 2:45
Exactly, you know, the closer it is between seeing it and hearing it, the closer that lightning is. So that's the same basic way that GPS works. All of these satellites are in orbit, they're all in a fixed spot. The software knows exactly where they are. So the satellite identifies itself, and then sends a high precision time code. So satellites that are further away the time code is going to be older than satellites that are closer to you, they're going to have a newer time code. So that's how GPS works. And sitting there listening to those times code and deciding, oh, that satellite is further away than that satellite. And it's so much further based on this real high precision time code. So there you go. There's a geek moment of the morning. But the problem that we're looking at right now is these older devices, including older airplanes, bridge control systems, systems that change traffic from one direction to another direction at a certain time of day, many of those relies heavily on GPS, not to position themselves necessarily, but to get an accurate time. So they will they want to know when 3pm is why not listen to those high precision atomic clock that are being broadcasted all over the world?

Danny 4:14  
We have one here.

Craig 4:16 
And you do exactly. Now I have one at my house, do we use them to synchronize all of our computers' clocks. Well, older GPS systems have an overflow problem. I know you mentioned earlier this morning Y2K. And we were very worried about Y2K, because many programmers like myself programming in the 70's and the 60's, we were too worried about whether or not 70 meant 2070 or 1970. We knew that 70 meant that our clock or our timestamp was really 1970. And so we had that two digit year, here comes 2000 that rolls over, there were some problems but it wasn't catastrophic. Well, how about all of these embedded systems, when was the last time you upgraded the firmware in your car?

Craig 5:09
When was the last time you updated the firmware in your firewall or your router. And hopefully, you do that pretty frequently. But I can tell you 99% of people never ever touched them. So about two weeks ago, in San Francisco, there was a conference, a security conference, and there was an expert out there saying that he will not fly, he will not get in an airplane on April 6. And the reason for that. And this by the ways of VP over at Trend Micro and Bill Malik is his name. And the reason is because the counters in the older GPS systems are going to overflow on April 6. It is going to reach the end of their counters are going to ramp back to zero.

Danny 5:57
So in theory the GPSs might not be set up properly. And you,yeah, I know, it makes sense why you might not want to fly that day.

Craig 6:03
Exactly. So there's more than him that just isn't going to fly that day. But this is a warning that was initially issued in April 2018. We have all of these older systems, and then some of them are guaranteed to have problems on April 6th. Hopefully, none of our airplanes do. But this could this could be real catastrophe. He's saying, now Trend Micro, they deal a lot with computer security systems. And, and, you know, maybe, maybe he's trying to get a little bit of news. But I know personally that the GPS systems that were made 20 years ago were very primitive. They're embedded in all kinds of devices. And the risk here is substantially greater than the risk we had with Y2K because the Y2K bug, there were very few systems that could, if they failed, cause people to die. These GPS systems that are embedded could cause people to die. And April 6 is the day. So fingers crossed, the manufacturers and owners of all these systems have taken care of it.

Danny 7:10
So that was my next question then. So here's the big question is what's being done to either prevent this, or we just waiting till April 6 and saying waiting to see what happens?

Craig 7:20
Well, there are a lot of companies that waited until January 1, 2000, to figure out if anything was going to happen. This time around. I think there's a lot of companies that aren't even aware, including government agencies that aren't even aware that there could be a problem. So there's certainly a lot of companies that have taken care of this already, some government agencies that have but if there is 20 year old hardware out there somewhere and think about military systems. And again, think about airplanes, 20 year old hardware, is it going to have this problem. Commercial airlines, I would expect to all of them have taken care of this problem. They've looked into it, these aren't idiots out there. But when it comes to some of these systems that are sitting in the back corner, just plugging away every day. That's where I'm getting really worried.

Craig 8:09
Well, that's it. You have that from Craig. Moving on though, I do want to hit a couple more topics before we have to let you go. The hackable smart alarms turns out, thieves may not even need a key or tools to steal your car from that one.

Craig 8:22
Yeah, this goes back again to so many businesses, just not being aware of the security implications of what they're doing. Car security alarm companies for years and decades. I remember buying these things in the 80's right and earlier, they were very simple. And if a switch was thrown, the alarm went off. Nowadays, they're putting APIs, application programming interfaces into their software, and just all kinds of smart technology. And we now have some penetration testing companies, including one over in the UK called Pentest Partners. They've been looking at these smart alarms after they heard about a problem. So they found that the Viper smart alarm and products from Pandora who makes alarms were riddled with all kinds of security flaws. And they found that they could steal a car fitted with any of these affected devices. They could steal them, they could shut off the engine and talking about wrecking havoc, they could cause the cars to go into full throttle mode while they're out on the road. Which means if you want to kill a lot of people and create a lot of havoc, sounds like it's simpler than we would hope.

Danny 9:42
There's a lot more than just stealing a car. It's taking complete control of that cars there, Craig.

Craig 9:48
Exactly. without doing anything, you know, we had the Chrysler problem where you could hack their entertainment system and take over the whole car, but you had to have physical access to that Chrysler car in order to do it. This doesn't require any physical access to the car. It can all be done remotely. 

Danny 10:09
It's certainly scary stuff Craig. Thank God, we have people like you keeping us safe. As always, we have so much stuff here. We never didn't get to somebody wants to hear more. What can they do?

Craig 10:18
Well, they can text me and I want to put one more quick warning in. Google's warning, everyone that's using Windows 7 to abandon it immediately. Windows 7. This is a warning out of Google and their security department. They say you need to upgrade to Windows 10 immediately. There is a huge security flaw with Windows 7. But you can text me 855-385-5553. That's 855-385-5553.

Danny 10:50
Standard data and messaging rates do apply. Craig, appreciate the time and we'll talk again next week.

Craig 10:55
Hey, thanks Danny. Take care.

Danny 10:56
As always. Craig Peterson there with some great stuff for us here on a Tuesday morning.

Craig 11:03
Hey, everybody. If you enjoy my podcast, make sure you let me know and subscribe. subscriptions is how we move up in the charts. That's how other people find us. So go to  http://CraigPeterson.com/iTunes. That'll take you directly to the 800 pound gorilla, which of course is Apple and you can subscribe right there. You can subscribe on almost anything frankly, I'm out there all over the place. And then once you subscribe. If you think I'm worth five stars, by all means, please put in a five star rating. I'd appreciate it. All right, everybody take care of we'll be back tomorrow from Maine.

---

Don't miss any episode from Craig. Visit http://CraigPeterson.com/itunes. Subscribe and give us a rating!

Thanks, everyone, for listening and sharing our podcasts. We're really hitting it out of the park. This will be a great year! 

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Craig is with Jack Heath this morning talking about the tech side of Beta O'Rourke's campaign.

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles 

---

Below is a rush transcript of this segment, it might contain errors.

Airing date: 03/18/2019

Technology Behind Beta O'Rourke Campaign

Craig Peterson 0:00
Good morning, everybody. Craig Peterson here this morning I was on with Jack Heath. And of course he is on dozens of stations here in the northeast. And I wanted to talk with him about politics because that's what his big thing is. Right? New Hampshire. Our state sport is politics. There's no question about it. Well, I found some really interesting things about what Beta O'Rourke is doing. And about the future of campaigning. It was fascinating to me to find out some just records that Beta had said.

Jack Heath 0:36 
Joining us now on the Auto Fair listener lines, Craig Peterson, our Tech Talk guy. And Craig, good Monday morning to you. How are you?

Craig 0:44 
Hey, good morning, Jack. I've been watching this of Beta O'Rourke campaign from a technology side and I found a bunch of interesting things about him. You were just talking about as money bomb, right?

Jack 0:56 
Yeah, I guess he's done well on the fundraising, right.

Craig 1:00
He has and I look back to what he had been doing during his race against the, you know, Texas Senator Ted Cruz and how did he raises money and I found an article online talking about what he had done. And it was one of the campaign workers. In fact, that was kind of giving this information out. But apparently what he ended up doing is beta took the same fundraising company that Bernie Sanders had been using in his run for the presidency last time against Hillary Clinton. And some of the people ended up leaving that particular agency. He followed them to a new agency. And then what he's doing is entirely a modern campaign. You know, back in the day, we used to send mailings out and get them in our mailbox every day, looking for money, trying to get people to, you know, get on board. And what O'Rourke's been doing is completely different? He does. He didn't have campaign field offices only had 10 of them across the entire state of Texas. He used social media and he got volunteers to put together what he was calling pop up campaign offices. He had almost 900 of them across the state of Texas. He was using advertising and is right now as well. Looking at his run up here before he announced. He had more than 330 different ads running just on Facebook to try and hone his message. See which adds brought in money which ads brought in people to sign up for his email list. Let me tell you, Jack this Beta O'Rourke is somebody who's really using modern technology in order to to build his base and bring in record amounts of money. The 38 million dollars he raised to go against Ted Cruz was just phenomenal.

Justin 3:00
And Craig you probably know this. But yeah, Beta O'Rourke is part of a hacker group in the 80s known as the Cult of the Dead Cow went back when hacker groups were less nefarious than they are now so yeah he's he's been involved in tech for a while here.

Craig 3:20
Well I remember that. In fact I hadn't heard about it for years Justin. The whole Cult of the Dead Cow and everything else that was going on and the time was when a hacker wasn't a bad guy. You know, hackers used to be people who were just hacking at code. They weren't professionals. They didn't really know programming that well but they like to do it. Nowadays. We call hackers you know that from back in the 80s we call people hackers who are people who just learned programming in 30 days by reading a book and go into a Microsoft site you know that that type of person but yeah, you're right. Justin. He was hacking back then. But back then we used to call bad guys crackers. And we used to call non professionals, hackers. Today we don't use the term cracker anymore. And hacker has nefarious overtones to it. I don't know if I explained that well or not.

Jack 4:19 
Well, one of the things I guess he's taken some heat on is something he had written as a hacker about hitting some kids while driving. And, you know, obviously, you know, all these candidates, speaking of social media, they're all gonna have to be very careful right, on what they say. or post or because everything will be sanitized for sensitivity.  Correct. You know, I just everything's scrutinized, but certainly he and others will more and more the way the electronics are changing will convert that to their campaign no doubt is because so much is now social media and technology.

Craig 4:50 
But look at Chelsea Clinton this past week where she was confronted by some of the some students and they were just jumping down her throat because of things that she said, and they were blaming her for the massacre somehow in New Zealand. And her words were extremely carefully chosen because Jack, you're so spot on things that we say even things we don't put up on social media, people are going to keep them. Just just last week we had two weeks ago now we had a leak of some audio from years ago that's causing a politician nothing but headaches. So yeah, I think everybody has to be careful because even if you're going to be a CEO of a company or some high level manager, things you said today even things you didn't post but someone else recorded you saying it, are going to pop up. Now in New Hampshire, we are not a two party state so it is illegal unless they change that law. Recently, it is illegal in New Hampshire for you to record someone without their knowledge and permission. But believe me, people are filming everything, recording everything. And stuff you say it's going to come back to haunt you.

Jack 6:00
All right Craig Peterson, good stuff good stuff this morning. Http://CraigPeterson.com, our Tech Talk. Thank you Craig.

Craig 6:08 
Hey thanks Jack.

Hey, I have a quick question for all you guys and gals listening on the podcast. I've been doing my security thing podcast just you know, couple of week and I've been including them in this podcast stream and I'm thinking about continuing that and then maybe even expanding it and putting it up on YouTube as well as video What do you guys think? Do you think that that's something be worthwhile letting you know about security incidents really kinda like a little bit of a deeper dive into the news. Let me know. [email protected]. I'd be really interested to know if you think that would be useful. I think it'd be useful for you but you know, you have to put a lot of work into it. So at least I'd like some validation, right. Just [email protected]. Do you think I should go ahead and put together a little YouTube channel? You know, it's a security thing. Take care guys. Bye bye.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Message Input:

Message #techtalk

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

s 737 Crash - NSA Surveillance Program

Craig Peterson 0:00

Craig is with Jack Heath this morning talking about the tech side of Beta O'Rourke's campaign.

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles 

---

Below is a rush transcript of this segment, it might contain errors.

Airing date: 03/18/2019

Technology Behind Beta O'Rourke Campaign

Craig Peterson 0:00
Good morning, everybody. Craig Peterson here this morning I was on with Jack Heath. And of course he is on dozens of stations here in the northeast. And I wanted to talk with him about politics because that's what his big thing is. Right? New Hampshire. Our state sport is politics. There's no question about it. Well, I found some really interesting things about what Beta O'Rourke is doing. And about the future of campaigning. It was fascinating to me to find out some just records that Beta had said.

Jack Heath 0:36 
Joining us now on the Auto Fair listener lines, Craig Peterson, our Tech Talk guy. And Craig, good Monday morning to you. How are you?

Craig 0:44 
Hey, good morning, Jack. I've been watching this of Beta O'Rourke campaign from a technology side and I found a bunch of interesting things about him. You were just talking about as money bomb, right?

Jack 0:56 
Yeah, I guess he's done well on the fundraising, right.

Craig 1:00
He has and I look back to what he had been doing during his race against the, you know, Texas Senator Ted Cruz and how did he raises money and I found an article online talking about what he had done. And it was one of the campaign workers. In fact, that was kind of giving this information out. But apparently what he ended up doing is beta took the same fundraising company that Bernie Sanders had been using in his run for the presidency last time against Hillary Clinton. And some of the people ended up leaving that particular agency. He followed them to a new agency. And then what he's doing is entirely a modern campaign. You know, back in the day, we used to send mailings out and get them in our mailbox every day, looking for money, trying to get people to, you know, get on board. And what O'Rourke's been doing is completely different? He does. He didn't have campaign field offices only had 10 of them across the entire state of Texas. He used social media and he got volunteers to put together what he was calling pop up campaign offices. He had almost 900 of them across the state of Texas. He was using advertising and is right now as well. Looking at his run up here before he announced. He had more than 330 different ads running just on Facebook to try and hone his message. See which adds brought in money which ads brought in people to sign up for his email list. Let me tell you, Jack this Beta O'Rourke is somebody who's really using modern technology in order to to build his base and bring in record amounts of money. The 38 million dollars he raised to go against Ted Cruz was just phenomenal.

Justin 3:00
And Craig you probably know this. But yeah, Beta O'Rourke is part of a hacker group in the 80s known as the Cult of the Dead Cow went back when hacker groups were less nefarious than they are now so yeah he's he's been involved in tech for a while here.

Craig 3:20
Well I remember that. In fact I hadn't heard about it for years Justin. The whole Cult of the Dead Cow and everything else that was going on and the time was when a hacker wasn't a bad guy. You know, hackers used to be people who were just hacking at code. They weren't professionals. They didn't really know programming that well but they like to do it. Nowadays. We call hackers you know that from back in the 80s we call people hackers who are people who just learned programming in 30 days by reading a book and go into a Microsoft site you know that that type of person but yeah, you're right. Justin. He was hacking back then. But back then we used to call bad guys crackers. And we used to call non professionals, hackers. Today we don't use the term cracker anymore. And hacker has nefarious overtones to it. I don't know if I explained that well or not.

Jack 4:19 
Well, one of the things I guess he's taken some heat on is something he had written as a hacker about hitting some kids while driving. And, you know, obviously, you know, all these candidates, speaking of social media, they're all gonna have to be very careful right, on what they say. or post or because everything will be sanitized for sensitivity.  Correct. You know, I just everything's scrutinized, but certainly he and others will more and more the way the electronics are changing will convert that to their campaign no doubt is because so much is now social media and technology.

Craig 4:50 
But look at Chelsea Clinton this past week where she was confronted by some of the some students and they were just jumping down her throat because of things that she said, and they were blaming her for the massacre somehow in New Zealand. And her words were extremely carefully chosen because Jack, you're so spot on things that we say even things we don't put up on social media, people are going to keep them. Just just last week we had two weeks ago now we had a leak of some audio from years ago that's causing a politician nothing but headaches. So yeah, I think everybody has to be careful because even if you're going to be a CEO of a company or some high level manager, things you said today even things you didn't post but someone else recorded you saying it, are going to pop up. Now in New Hampshire, we are not a two party state so it is illegal unless they change that law. Recently, it is illegal in New Hampshire for you to record someone without their knowledge and permission. But believe me, people are filming everything, recording everything. And stuff you say it's going to come back to haunt you.

Jack 6:00
All right Craig Peterson, good stuff good stuff this morning. Http://CraigPeterson.com, our Tech Talk. Thank you Craig.

Craig 6:08 
Hey thanks Jack.

Hey, I have a quick question for all you guys and gals listening on the podcast. I've been doing my security thing podcast just you know, couple of week and I've been including them in this podcast stream and I'm thinking about continuing that and then maybe even expanding it and putting it up on YouTube as well as video What do you guys think? Do you think that that's something be worthwhile letting you know about security incidents really kinda like a little bit of a deeper dive into the news. Let me know. [email protected]. I'd be really interested to know if you think that would be useful. I think it'd be useful for you but you know, you have to put a lot of work into it. So at least I'd like some validation, right. Just [email protected]. Do you think I should go ahead and put together a little YouTube channel? You know, it's a security thing. Take care guys. Bye bye.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Message Input:

Message #techtalk

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

s 737 Crash - NSA Surveillance Program

Craig Peterson 0:00

Have you heard about sextortion?  We will talk about this type of blackmail scam and why it is so dangerous.  

Android vs. iPhone, what is your choice? Today, we're going to talk about it from the resale value side

What's up with GPS systems? Why are some experts not flying on  April 6?  I got some news and explanations for you.

And we have a report out of the UK, The Guardian about how easy it is to steal modern cars.  We will discuss why that is. 

Did you hear about the warning from Google this week? We will get to that and some other unexpected actions from Google

For more tech tips, news, and updates visit - CraigPeterson.com

---

Transcript:

Below is a rush transcript of this segment, it might contain errors.

Airing date: 03/16/2019

Duckduckgo For Search - Google Advisory On Windows 7 - Cars Hacked Via Their Security Systems

Craig 0:00 
Hi, everybody, we're up to show number 998.

Craig 0:12

Does that mean we have to do something special, coming up here in a couple more shows? I can't believe 1000 weeks worth of shows. I don't number my shows based on the,

Craig 0:21

you know how many times I've appeared or how many times I've put podcasts up. Because I do, sometimes five. I've done as many as a dozen different podcasts in a week before. So I don't add them up like that. I'm talking about 1000 weeks on the air, on the radio. That is absolutely fantastic. It's frankly, it's just so exciting. I'm glad that it's happening. Well, today, we are going to be talking about sextortion. You might have seen this, I had one of the listeners reach out to me about this just a couple of weeks ago. And in fact, it happened to me, as well. We'll talk about Android vs. iPhone. This time, we're going to talk about it from the resale value side. GPS systems, April 6, I got some news for you. Some experts have decided they're not going to fly on April 6th, explain why. And we have a report out of the UK, The Guardian about modern cars much easier to steal than the old ones, and why? Google has a very big warning out this week that will get to. And Google did something else that was not expected by a lot of people. Google has quietly added Duck Duck Go as a search engine option for Chrome users. This is about 60 different markets globally in this is really big news. Because the chromium engine, of course, is made by Google. And you know, already the Google is very big in the search engine space. So, having them promote, which is what this effectively is doing. Having them promote competitors is a little bit of surprise to everybody out there. Now, chromium, I mentioned this a few weeks ago, which is the underlying technology for Google's Chrome browser is being adopted by Microsoft, they are completely shooting their own browser projects in the head. And they're building it all on top of chromium now, which I think makes a whole lot of sense. So does that mean Microsoft now is going to be using Duck Duck go, let me explain what this is? For those who are wondering, Duck Duck Go isn't just a kids game from 50 years ago, or probably longer than that, actually duck Duck go is a search engine. And it is designed with privacy in mind. I've had the founder of Duck Duck Go on my radio show before we talked a little bit about what he was doing. This was some years back when he was first getting started. And I'm actively promoted since then. And since using it, frankly. But people are saying, well, Duck Duck Go is the search engine to use because it is not tracking what you're searching for. It's just giving you kind of general advertisements, just like Google used to 10 years ago. And other people are saying, Well, why would I use Duck Duck go when Google has, frankly, better search engine technology, which it does, in many ways. Google has been able to invest a lot of money into its search engine technology and Duck Duck go just really can can't, at least not to the level that Google can. Now some people who are kind of skeptical, myself included are thinking that maybe Google did this with chromium in order to avoid some of the antitrust scrutiny. The anti-combines laws that are in Canada, UK much throughout the Commonwealth, but it is good news for people

Craig 3:59

I use Duck Duck Go as my first go to choice when I'm searching online, it doesn't track you it, I kind of like it, it doesn't always give me the results that I really need or really want. So for those types of results, sometimes I'll end up going to Google and check there. And I use Bing for some types of searches to. I find bings image search to be a little bit better, in some ways than Google Search. Bing doesn't have the reverse image search that Google has. But you know, all in all, I think it's pretty good. There's another pro-privacy search engine out there called quant I've used that before q, w, a, n t and chromium Google now offers that is another default. So you might want to look at that Duck Duck Go and QUANT and QUANT, by the way, is only available as a default over in France, which is where QUANT is from. But you can always just go to Q U A N T dot com or Duck Duck Go dot com. And you can use it in almost any browser out there as a default, and it's been added in I'm looking through the list Canada, basically all of our neighbors, I don't see Mexico on here. That's kind of interesting. See the UK, US Venezuela is, you know, if they get power back down there, they'll be able to use it. Good old socialist countries, right. So anyways,

Craig 5:30
it's been growing for years, it's really quite good. And this Chromium instance, available on GitHub, if in case you're a developer is worth looking at. I also when we're talking about Chromium, I got to make sure I mentioned my other browser, my favorite browser for privacy. And that's the Epic browser. E-P-I-C. And I think on today's coaching call, we're going to end up talking a little bit about that Epic browser. Because a lot of people are kind of concerned and confused. And the Epic browser also uses Chromium as a code base, which I think is good, because Chromium is kind of those standard but it also just dropped a note down for myself. But it also has the types of security the DuckDuckGo has, in fact, it's kind of tied in hand in hand, it has VPN routes through it used to just be Indiana out routes through a whole bunch of different places. So check it out. E-P-I-C, browser.com. Epic browser.com online and use DuckDuckGo whenever you can, for your searches. If you want to try and keep things a little bit on the private side. And if you're very paranoid, your best bet mom depends on how paranoid right if you're like crazy paranoid, we're you know, we're not going to talk about that right now. I could help you out. But if you're more paranoid do the other thing I do, which just switches it up, use different search engines use different browsers use different machines when it comes to banking because I don't want many my banking information to be stolen. And I got to get back to some of what I'm doing some of it. Some of it I'm not if you're interested, let me know might be worth doing a masterclass about you know how to do this, how to do it for free even and keep your banking information safe. So I should write a little note about that. Well, we have a warning from Google, we're going to get into that right now.

Craig 7:33
Well, our friends at Google have been paying attention to security for a while, if you have the latest versions of the Google Chrome browser, you're getting automatic updates. It's a technology that Firefox Mozilla people have been using for a long time.

Craig 7:48
And these auto updates are absolutely fantastic. It can just save you a ton, not only of time but not having to apply the updates. But you know, security people can break in and drive-by download, you know, all the crap that happens when you're online. So Google has been very good about updating their Google Chrome browser, the Chromium underpinnings and you know, they get updated as well. But then the browser is really where they're most interested. Well, now, Google is warning people about Windows 7, you know, if you're listening for a while, that a month or so ago, Microsoft told you to ditch to drag Internet Explorer into that trash can and never use it again. You know that right? Number two now with Google out here is Google's recommending Windows 7 users to stop using Windows 7 upgrade immediately to Windows 10, if at all possible. And this is because of something called a kernel vulnerability. The kernel is the core part of the operating system. The kernel is where everything happens, really the kernel is how all of the processes talk to each other, how they can access hardware resources, like the disk, or the camera, the microphone, the speakers, everything on your computer ultimately goes through what's called the kernel.

Craig 9:18
Wow. Well, the third analysis group is explained that Google's discovered two different security vulnerabilities, one in the Google Chrome browser. And the other one in Windows. The Chrome bug was already patched. But Windows 7 not yet fixed. Now this month, the Patch Tuesday from Microsoft has a doozy set of patches, a whole bunch of them, Microsoft is fixing all kinds of major flaws and vulnerabilities in their software. I don't think this particular fixes in that patch set. But it'll be out sometime, I'm sure Microsoft saying the vulnerability is in the Win32k.sis kernel driver. And it can be used as a security sandbox escape. Now, this is getting all rather technical, but sandboxes are where you set up a basically a way to execute software that nothing else can get access to. And it can't get access to anything else as well. So you use sandboxes for security. And having a major security problem with the security sandbox obviously is very big. So here's the statement we strongly believe this vulnerability may only be exploitable on Windows 7, due to recent exploit mitigation to added newer versions of Windows, Windows 10, and eight, all the Windows 10 has the most fixes. They've done a lot there.

Craig 10:53
They're trying to make it as good as Mac OS. It'll be a while before they get there. But they're almost to the point that Unix was at 20 years ago. So you know, kudos to Microsoft. To date. Back to the quote to date, we have only observed active exploitation against Windows 7 32 bit systems. So the note from our friends at Google and their security research team is get rid of Windows 7 upgrade to Windows 10 as soon as you can. Microsoft says it is working on a fix. They are publicly disclosing the existence they're saying it is a serious vulnerability. So they're admitting it no big deal. There will see, By the way, Windows 7 is reaching the end of support the end of 2019, it's actually January 2020, read it however you want. But you've only got months left before Windows 7 will no longer get patches unless you pay Microsoft a king's ransom. In other words, our federal government will be spending a lot of software with Microsoft. I'm sure in the years ahead. It's still paying Microsoft to support Windows XP. Isn't that crazy? Let's talk about our new cars for a second

Craig 12:19
We talked last week a little bit about our cars and insurance with autonomous vehicles. What does it mean? When are things going to get better? When are they going to get worse? Well, we have more smart in cars today. They have something called CAN bus which links up all of these computers throughout the machine throughout your car. You know, most cars nowadays and more modern ones, they don't even have a connection from your stereo to the speakers directly. There's no amplifier in there. It's all going over this network in your car, little land in the car. Well, that means that computers are there and they can be exploited. We have already seen that we saw a hack that went through the radio in some of the Chrysler products and allowed people to remote control Chrysler cars if they use this hack on their radios. So it is a concern. I'm not sure they've addressed it all well enough and not just talking about Chrysler here I'm talking about everybody gets me very concerned. There's been issues with BMW and others in the past as well. Well, there's a British infosec company called Pen Test Partners and they found that the Vipers Smart Start alarm and products from Pandora were riddled with flaws. And these flaws allowed them to have an attacker steal a car fitted with one of these devices. So if you have a Viper Smart alarm, the Smart Start alarm, which I do know people who have this. I'm gonna have to reach out, let them know individually case they're not listening today. But the Viper Smart Start alarm and products from Pandora allow cars to be hijacked. And now here's from a blog post about they're finding from Pen Test Partners. Before we contacted them, the manufacturers had inadvertently exposed about 3 million cars to theft and their users to hijack.

Craig 14:28
This is a very, very big deal. This was really started because of Pandora's alarms. The company noticed that their security was advertised as being on hackable, which is a bad thing to say right? What's on the hackable. So I guess Pen Test Partners took that as a challenge. And they found an API, which is this application programming interface and some simple parameter manipulation that allowed them to be able to change the Viper Smart Start user's account password, registered email addresses, giving them full control over the app. And the car that the alarm system was installed on. All they had to do was send a regular web post request to the API with a parameter email redefined to one of their own choices, and that overrode the legitimate owner's email address, and now they had control over the account. So there you go. Okay, major issues using the apps ability to clone the key fob issue RF commands from a user mobile phone. And they dug into this little bit more, by the way, and they discovered a function in the Viper interface that remotely turned off the car's engine. So the pen or a big also allowed researchers to remotely enable the car's microphone so they could listen to eavesdrop the conversation on the occupants. And they also said the Mazda 6, the Range Rover Sport, the Kia, what is this, Course I guess. The Toyota Forerunner, Mitsubishi Pajero, Toyota Prius 50, and the Rav4 all appear to have undocumented functionality present in the alarm API to remotely adjust the cruise control speed. So it goes on and on car, security remains poor, and you don't need guns, you don't need lock picks, to steal modern cars, or to even to cause them to crash. I wonder if, if any of the crash investigators might look into this, if they realize, wait a minute, there's a remote controllable API in this car, maybe we should subpoena the court records from the manufacturer of the device and poke around a little bit and see if maybe someone manipulated it and told the car to floor it down a back road Street, we're going to have to get a little smarter about some of this stuff, right? Even though the criminal investigations. Well, let's talk about April 6 here. Wow, this is something I wasn't even aware of this until just this week.

Craig 17:21
Of course, I was aware April 6 was coming people, okay. Don't give me a hard time about that. Because, you know, I gotta remember April 8, which is my anniversary, right? So I don't want to mess this up. April 6. Anyhow, I knew the 6th was coming. And it's certainly getting close. But this has to do with GPS systems. If you remember, 1999, if you were doing programming, if you were involved with computers back then, it was a scary time, many people kind of predicted the end of Western civilization. And they weren't totally wrong about that either. Western civilization could really have come to an end because of what was called the Y2K bug. And it was because of programmers like me, in the 70s and 60s that wrote software that said, Well, if I want to figure out the time between this date, and that date, all I have to do is use it two digit year, and those two-digit years, going to take up less space in the storage. And if you have a million records, times two more digits, which typically would be 2 bytes, then well, that's, you know, 2 million more bytes of data, which at the time was a whole lot of data. So we took shortcuts, and one of the shortcuts was storing the year as just the last two digits. So we didn't worry about the 19 part, we only worried about the 79 part or the 99 part. So there were a lot of predictions about software. And I knew a guy who started the company that was designing software to specifically look for this Y2K flaw and fix it. Of course, as it turned out, there were some problems, they were relatively minor. But most of the companies out there are certainly the ones that were in business realized that Y2K was coming and made some basic adjustments so that there wouldn't be a big problem. Many people expected, they're not to be another problem until maybe the year 10,000, right. So instead of Y2K, in the future, we're probably not going to be around. But in another 8000 years, we got another rollover. Well, that's not the case.

Craig 19:43
I have been aware of what's called the 2038 problem. Because in the Unix world, there's a timestamp the Network Time Protocol uses and many machines user, which means by the way, Windows uses us to synchronize times, well, that particular clock is going to roll over in the year 2038. And that's most likely to affect embedded systems. Now, there are fixes already in place, and many versions of Unix that are out there Linux and some of these other derivatives that are have already taken this into account. And then, of course, there's bad programmers that really don't realize all of the implications of what they do.

Craig 20:27
They've always existed and they'll always exist. In fact, I think in many ways, it's getting worse than it was before, you know, the bad programmers that is.

Craig 20:34
But maybe that's because I'm just getting to be an old man, right? been doing this for too long. So we know that the Y2K problem was real. And in most cases, it was fixed, that 2038 problem is real. Most cases it will be fixed, although again, we're going to be affecting embedded systems and most, In other words, those that don't get the software update one was alive last time you upgraded the software in your car, or some other physical device to clock on your disk. Hopefully, none of it's going to be life-threatening, because some systems are using Unix that is embedded systems. Well, there's another one, this is the April 6

Craig 21:18
bug. And this has to do with the GPS and there are some security experts, including one guy over at RSA. And RSA does a whole ton of security work. They provide some of the algorithms that run public key systems. They have little key fobs, little devices that have a timer on them, you've seen them before. It's a little number that rolls over every minute or so. And you might use them with your banks, etc. Well, those guys are the guys that are now warning about this April 6 problem. They talked about it at a security conference just last week out in San Francisco. And he says that some of the older GPS systems are going to be in serious trouble. Because the computers in these GPS systems are going to have counters that flip back to zero. So they are going to literally run out of time reaching the end of their counters. And that really could cause some major major effect. This guy here. Bill Maliki's there's another guy he's a VP over Trend Micro, they do a lot of computer security, cybersecurity. We've used some of their stuff in the past, he told the media that he would not be flying on April 6 and suggests that it could be bad, it could be a lot worse than Y2K was because the effects are going to be more widespread, widespread because many more systems have integrated GPS into their operations. And many of these are embedded systems ports. He's talking about here, loading unloading containers automatically, using GPS to guide the cranes. Some of those systems could be affected in the cranes are going to shut down. Hopefully, public safety systems use GPS traffic monitoring systems for bridges, the bridges that raise and lower automatically the ones that change the lanes ever been on one of those roads were part of the day. This lane is northbound. The other part it's southbound, you know, 20 years ago, these GPS systems were really important primitive shape, and they were embedded. So the impact on this could be even greater governments have issued warnings to state and private sectors to update their technology. But some of these systems we not, we're not even aware of how some of these work that companies have gone out of business, there's no way to get an update. Nobody really realizes their GPS in there. Because you remember, GPS isn't just used to locate you. GPS is used to locate because it uses very fancy high-resolution timers. And the way it works to locate you is it listens for the satellites to send a clock signal.

Craig 24:24
So each of the clocks will announce what time it is. And because the satellites are different distances from you, you will hear the time at different times. Right? You know, that if someone's yelling at you from across the room, have you here or you see a gunshot and range you will see the gunshot before you hear it. Right. Well, if someone fires that gun, right next to you, you're going to hear it instantly correct. So you know, that the the guy that fired the gun, and it took a second for that Soundwave to reach you, you know, that guy's further away than the guy who fired the gun. And immediately you heard it. Well, that's how GPS works using extremely high precision timers. So another thing people do with GPS signals is they use it to get a clock source. So many computers are using GPS receivers to figure out what time it is. So the systems are reverse traffic that controls bridges, etc, etc. Many of them are sinking their clocks and their timers up to GPS. And when it's an embedded system that hasn't been updated, we could have some serious serious problem couple of real quick things here before we go today. And of course, you'll find these articles and many more up on my website. http://CraigPeterson.com. I have also been doing a special podcast called It's A Security Thing, you're not going to find it unless you look for me because I haven't split it out yet. But in it, I'm talking about these types of security issues, things in the real world. This week. I was talking about a CPA firm what they did to respond to a cybersecurity event two weeks ago this happened, what they did right what they did wrong and you will find all kinds of these things are posting them almost daily. Now at my website, there's a special section, http://CraigPeterson.com. So make sure you have a look at it. We are writing all of these articles ourselves. These are not references to other articles. There might be links to other articles, but these are really great. If you're interested in cybersecurity and finding out more you'll find them on my home page again, http://CraigPeterson.com and it's all small businesses. It's all things that did right things that did wrong and what happened and they're all very, very current. So check it out. You really really should and wearing sending include some of those also in my weekly email. If you're not a subscriber /http://CraigPeterson.com/subscribe. Apple is crushing it on resale value in their laptops. But also the iPhones they destroy the Android iPhone X versus a Samsung Galaxy S9 Wow, iPhone X was 1000 bucks when it debuted, it's still worth 700 9 months later. So that's a drop of 30% the Samsung Galaxy S9 costs 720 but it was worth just $290 and drop 60%. So consider that too. When you're looking at the prices of devices what you should be mine and by the way, you should be buying the iPhone. Hey, have a great week. Make sure you check us out online. http://CraigPeterson.com. Take care everybody and we'll be chatting again next week. Bye-bye.

--- 

Related articles:

'Gps Systems Will Be Struck By Y2K-Like Bug On April 6': Security Expert Says He Will Not Fly On 'Day Zero' After Governments Warn Global Devices Will Reset Due To Calendar Glitch

Google Recommends Windows 7 Users To Upgrade To Windows 10 If Possible, As A Kernel Vulnerability Allows For Local Privilege Escalation On The Operating System.

No Guns Or Lockpicks Needed To Steal Modern Cars If They're Fitted With Hackable 'Smart' Alarms

Sextortion Scammers Target Employees

Google Has Quietly Added Duckduckgo As A Search Engine Option For Chrome Users - Privacy

iPhone Crushes Androids On Resale Value

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Have you heard about sextortion?  We will talk about this type of blackmail scam and why it is so dangerous.  

Android vs. iPhone, what is your choice? Today, we're going to talk about it from the resale value side

What's up with GPS systems? Why are some experts not flying on  April 6?  I got some news and explanations for you.

And we have a report out of the UK, The Guardian about how easy it is to steal modern cars.  We will discuss why that is. 

Did you hear about the warning from Google this week? We will get to that and some other unexpected actions from Google

For more tech tips, news, and updates visit - CraigPeterson.com

---

Transcript:

Below is a rush transcript of this segment, it might contain errors.

Airing date: 03/16/2019

Duckduckgo For Search - Google Advisory On Windows 7 - Cars Hacked Via Their Security Systems

Craig 0:00 
Hi, everybody, we're up to show number 998.

Craig 0:12

Does that mean we have to do something special, coming up here in a couple more shows? I can't believe 1000 weeks worth of shows. I don't number my shows based on the,

Craig 0:21

you know how many times I've appeared or how many times I've put podcasts up. Because I do, sometimes five. I've done as many as a dozen different podcasts in a week before. So I don't add them up like that. I'm talking about 1000 weeks on the air, on the radio. That is absolutely fantastic. It's frankly, it's just so exciting. I'm glad that it's happening. Well, today, we are going to be talking about sextortion. You might have seen this, I had one of the listeners reach out to me about this just a couple of weeks ago. And in fact, it happened to me, as well. We'll talk about Android vs. iPhone. This time, we're going to talk about it from the resale value side. GPS systems, April 6, I got some news for you. Some experts have decided they're not going to fly on April 6th, explain why. And we have a report out of the UK, The Guardian about modern cars much easier to steal than the old ones, and why? Google has a very big warning out this week that will get to. And Google did something else that was not expected by a lot of people. Google has quietly added Duck Duck Go as a search engine option for Chrome users. This is about 60 different markets globally in this is really big news. Because the chromium engine, of course, is made by Google. And you know, already the Google is very big in the search engine space. So, having them promote, which is what this effectively is doing. Having them promote competitors is a little bit of surprise to everybody out there. Now, chromium, I mentioned this a few weeks ago, which is the underlying technology for Google's Chrome browser is being adopted by Microsoft, they are completely shooting their own browser projects in the head. And they're building it all on top of chromium now, which I think makes a whole lot of sense. So does that mean Microsoft now is going to be using Duck Duck go, let me explain what this is? For those who are wondering, Duck Duck Go isn't just a kids game from 50 years ago, or probably longer than that, actually duck Duck go is a search engine. And it is designed with privacy in mind. I've had the founder of Duck Duck Go on my radio show before we talked a little bit about what he was doing. This was some years back when he was first getting started. And I'm actively promoted since then. And since using it, frankly. But people are saying, well, Duck Duck Go is the search engine to use because it is not tracking what you're searching for. It's just giving you kind of general advertisements, just like Google used to 10 years ago. And other people are saying, Well, why would I use Duck Duck go when Google has, frankly, better search engine technology, which it does, in many ways. Google has been able to invest a lot of money into its search engine technology and Duck Duck go just really can can't, at least not to the level that Google can. Now some people who are kind of skeptical, myself included are thinking that maybe Google did this with chromium in order to avoid some of the antitrust scrutiny. The anti-combines laws that are in Canada, UK much throughout the Commonwealth, but it is good news for people

Craig 3:59

I use Duck Duck Go as my first go to choice when I'm searching online, it doesn't track you it, I kind of like it, it doesn't always give me the results that I really need or really want. So for those types of results, sometimes I'll end up going to Google and check there. And I use Bing for some types of searches to. I find bings image search to be a little bit better, in some ways than Google Search. Bing doesn't have the reverse image search that Google has. But you know, all in all, I think it's pretty good. There's another pro-privacy search engine out there called quant I've used that before q, w, a, n t and chromium Google now offers that is another default. So you might want to look at that Duck Duck Go and QUANT and QUANT, by the way, is only available as a default over in France, which is where QUANT is from. But you can always just go to Q U A N T dot com or Duck Duck Go dot com. And you can use it in almost any browser out there as a default, and it's been added in I'm looking through the list Canada, basically all of our neighbors, I don't see Mexico on here. That's kind of interesting. See the UK, US Venezuela is, you know, if they get power back down there, they'll be able to use it. Good old socialist countries, right. So anyways,

Craig 5:30
it's been growing for years, it's really quite good. And this Chromium instance, available on GitHub, if in case you're a developer is worth looking at. I also when we're talking about Chromium, I got to make sure I mentioned my other browser, my favorite browser for privacy. And that's the Epic browser. E-P-I-C. And I think on today's coaching call, we're going to end up talking a little bit about that Epic browser. Because a lot of people are kind of concerned and confused. And the Epic browser also uses Chromium as a code base, which I think is good, because Chromium is kind of those standard but it also just dropped a note down for myself. But it also has the types of security the DuckDuckGo has, in fact, it's kind of tied in hand in hand, it has VPN routes through it used to just be Indiana out routes through a whole bunch of different places. So check it out. E-P-I-C, browser.com. Epic browser.com online and use DuckDuckGo whenever you can, for your searches. If you want to try and keep things a little bit on the private side. And if you're very paranoid, your best bet mom depends on how paranoid right if you're like crazy paranoid, we're you know, we're not going to talk about that right now. I could help you out. But if you're more paranoid do the other thing I do, which just switches it up, use different search engines use different browsers use different machines when it comes to banking because I don't want many my banking information to be stolen. And I got to get back to some of what I'm doing some of it. Some of it I'm not if you're interested, let me know might be worth doing a masterclass about you know how to do this, how to do it for free even and keep your banking information safe. So I should write a little note about that. Well, we have a warning from Google, we're going to get into that right now.

Craig 7:33
Well, our friends at Google have been paying attention to security for a while, if you have the latest versions of the Google Chrome browser, you're getting automatic updates. It's a technology that Firefox Mozilla people have been using for a long time.

Craig 7:48
And these auto updates are absolutely fantastic. It can just save you a ton, not only of time but not having to apply the updates. But you know, security people can break in and drive-by download, you know, all the crap that happens when you're online. So Google has been very good about updating their Google Chrome browser, the Chromium underpinnings and you know, they get updated as well. But then the browser is really where they're most interested. Well, now, Google is warning people about Windows 7, you know, if you're listening for a while, that a month or so ago, Microsoft told you to ditch to drag Internet Explorer into that trash can and never use it again. You know that right? Number two now with Google out here is Google's recommending Windows 7 users to stop using Windows 7 upgrade immediately to Windows 10, if at all possible. And this is because of something called a kernel vulnerability. The kernel is the core part of the operating system. The kernel is where everything happens, really the kernel is how all of the processes talk to each other, how they can access hardware resources, like the disk, or the camera, the microphone, the speakers, everything on your computer ultimately goes through what's called the kernel.

Craig 9:18
Wow. Well, the third analysis group is explained that Google's discovered two different security vulnerabilities, one in the Google Chrome browser. And the other one in Windows. The Chrome bug was already patched. But Windows 7 not yet fixed. Now this month, the Patch Tuesday from Microsoft has a doozy set of patches, a whole bunch of them, Microsoft is fixing all kinds of major flaws and vulnerabilities in their software. I don't think this particular fixes in that patch set. But it'll be out sometime, I'm sure Microsoft saying the vulnerability is in the Win32k.sis kernel driver. And it can be used as a security sandbox escape. Now, this is getting all rather technical, but sandboxes are where you set up a basically a way to execute software that nothing else can get access to. And it can't get access to anything else as well. So you use sandboxes for security. And having a major security problem with the security sandbox obviously is very big. So here's the statement we strongly believe this vulnerability may only be exploitable on Windows 7, due to recent exploit mitigation to added newer versions of Windows, Windows 10, and eight, all the Windows 10 has the most fixes. They've done a lot there.

Craig 10:53
They're trying to make it as good as Mac OS. It'll be a while before they get there. But they're almost to the point that Unix was at 20 years ago. So you know, kudos to Microsoft. To date. Back to the quote to date, we have only observed active exploitation against Windows 7 32 bit systems. So the note from our friends at Google and their security research team is get rid of Windows 7 upgrade to Windows 10 as soon as you can. Microsoft says it is working on a fix. They are publicly disclosing the existence they're saying it is a serious vulnerability. So they're admitting it no big deal. There will see, By the way, Windows 7 is reaching the end of support the end of 2019, it's actually January 2020, read it however you want. But you've only got months left before Windows 7 will no longer get patches unless you pay Microsoft a king's ransom. In other words, our federal government will be spending a lot of software with Microsoft. I'm sure in the years ahead. It's still paying Microsoft to support Windows XP. Isn't that crazy? Let's talk about our new cars for a second

Craig 12:19
We talked last week a little bit about our cars and insurance with autonomous vehicles. What does it mean? When are things going to get better? When are they going to get worse? Well, we have more smart in cars today. They have something called CAN bus which links up all of these computers throughout the machine throughout your car. You know, most cars nowadays and more modern ones, they don't even have a connection from your stereo to the speakers directly. There's no amplifier in there. It's all going over this network in your car, little land in the car. Well, that means that computers are there and they can be exploited. We have already seen that we saw a hack that went through the radio in some of the Chrysler products and allowed people to remote control Chrysler cars if they use this hack on their radios. So it is a concern. I'm not sure they've addressed it all well enough and not just talking about Chrysler here I'm talking about everybody gets me very concerned. There's been issues with BMW and others in the past as well. Well, there's a British infosec company called Pen Test Partners and they found that the Vipers Smart Start alarm and products from Pandora were riddled with flaws. And these flaws allowed them to have an attacker steal a car fitted with one of these devices. So if you have a Viper Smart alarm, the Smart Start alarm, which I do know people who have this. I'm gonna have to reach out, let them know individually case they're not listening today. But the Viper Smart Start alarm and products from Pandora allow cars to be hijacked. And now here's from a blog post about they're finding from Pen Test Partners. Before we contacted them, the manufacturers had inadvertently exposed about 3 million cars to theft and their users to hijack.

Craig 14:28
This is a very, very big deal. This was really started because of Pandora's alarms. The company noticed that their security was advertised as being on hackable, which is a bad thing to say right? What's on the hackable. So I guess Pen Test Partners took that as a challenge. And they found an API, which is this application programming interface and some simple parameter manipulation that allowed them to be able to change the Viper Smart Start user's account password, registered email addresses, giving them full control over the app. And the car that the alarm system was installed on. All they had to do was send a regular web post request to the API with a parameter email redefined to one of their own choices, and that overrode the legitimate owner's email address, and now they had control over the account. So there you go. Okay, major issues using the apps ability to clone the key fob issue RF commands from a user mobile phone. And they dug into this little bit more, by the way, and they discovered a function in the Viper interface that remotely turned off the car's engine. So the pen or a big also allowed researchers to remotely enable the car's microphone so they could listen to eavesdrop the conversation on the occupants. And they also said the Mazda 6, the Range Rover Sport, the Kia, what is this, Course I guess. The Toyota Forerunner, Mitsubishi Pajero, Toyota Prius 50, and the Rav4 all appear to have undocumented functionality present in the alarm API to remotely adjust the cruise control speed. So it goes on and on car, security remains poor, and you don't need guns, you don't need lock picks, to steal modern cars, or to even to cause them to crash. I wonder if, if any of the crash investigators might look into this, if they realize, wait a minute, there's a remote controllable API in this car, maybe we should subpoena the court records from the manufacturer of the device and poke around a little bit and see if maybe someone manipulated it and told the car to floor it down a back road Street, we're going to have to get a little smarter about some of this stuff, right? Even though the criminal investigations. Well, let's talk about April 6 here. Wow, this is something I wasn't even aware of this until just this week.

Craig 17:21
Of course, I was aware April 6 was coming people, okay. Don't give me a hard time about that. Because, you know, I gotta remember April 8, which is my anniversary, right? So I don't want to mess this up. April 6. Anyhow, I knew the 6th was coming. And it's certainly getting close. But this has to do with GPS systems. If you remember, 1999, if you were doing programming, if you were involved with computers back then, it was a scary time, many people kind of predicted the end of Western civilization. And they weren't totally wrong about that either. Western civilization could really have come to an end because of what was called the Y2K bug. And it was because of programmers like me, in the 70s and 60s that wrote software that said, Well, if I want to figure out the time between this date, and that date, all I have to do is use it two digit year, and those two-digit years, going to take up less space in the storage. And if you have a million records, times two more digits, which typically would be 2 bytes, then well, that's, you know, 2 million more bytes of data, which at the time was a whole lot of data. So we took shortcuts, and one of the shortcuts was storing the year as just the last two digits. So we didn't worry about the 19 part, we only worried about the 79 part or the 99 part. So there were a lot of predictions about software. And I knew a guy who started the company that was designing software to specifically look for this Y2K flaw and fix it. Of course, as it turned out, there were some problems, they were relatively minor. But most of the companies out there are certainly the ones that were in business realized that Y2K was coming and made some basic adjustments so that there wouldn't be a big problem. Many people expected, they're not to be another problem until maybe the year 10,000, right. So instead of Y2K, in the future, we're probably not going to be around. But in another 8000 years, we got another rollover. Well, that's not the case.

Craig 19:43
I have been aware of what's called the 2038 problem. Because in the Unix world, there's a timestamp the Network Time Protocol uses and many machines user, which means by the way, Windows uses us to synchronize times, well, that particular clock is going to roll over in the year 2038. And that's most likely to affect embedded systems. Now, there are fixes already in place, and many versions of Unix that are out there Linux and some of these other derivatives that are have already taken this into account. And then, of course, there's bad programmers that really don't realize all of the implications of what they do.

Craig 20:27
They've always existed and they'll always exist. In fact, I think in many ways, it's getting worse than it was before, you know, the bad programmers that is.

Craig 20:34
But maybe that's because I'm just getting to be an old man, right? been doing this for too long. So we know that the Y2K problem was real. And in most cases, it was fixed, that 2038 problem is real. Most cases it will be fixed, although again, we're going to be affecting embedded systems and most, In other words, those that don't get the software update one was alive last time you upgraded the software in your car, or some other physical device to clock on your disk. Hopefully, none of it's going to be life-threatening, because some systems are using Unix that is embedded systems. Well, there's another one, this is the April 6

Craig 21:18
bug. And this has to do with the GPS and there are some security experts, including one guy over at RSA. And RSA does a whole ton of security work. They provide some of the algorithms that run public key systems. They have little key fobs, little devices that have a timer on them, you've seen them before. It's a little number that rolls over every minute or so. And you might use them with your banks, etc. Well, those guys are the guys that are now warning about this April 6 problem. They talked about it at a security conference just last week out in San Francisco. And he says that some of the older GPS systems are going to be in serious trouble. Because the computers in these GPS systems are going to have counters that flip back to zero. So they are going to literally run out of time reaching the end of their counters. And that really could cause some major major effect. This guy here. Bill Maliki's there's another guy he's a VP over Trend Micro, they do a lot of computer security, cybersecurity. We've used some of their stuff in the past, he told the media that he would not be flying on April 6 and suggests that it could be bad, it could be a lot worse than Y2K was because the effects are going to be more widespread, widespread because many more systems have integrated GPS into their operations. And many of these are embedded systems ports. He's talking about here, loading unloading containers automatically, using GPS to guide the cranes. Some of those systems could be affected in the cranes are going to shut down. Hopefully, public safety systems use GPS traffic monitoring systems for bridges, the bridges that raise and lower automatically the ones that change the lanes ever been on one of those roads were part of the day. This lane is northbound. The other part it's southbound, you know, 20 years ago, these GPS systems were really important primitive shape, and they were embedded. So the impact on this could be even greater governments have issued warnings to state and private sectors to update their technology. But some of these systems we not, we're not even aware of how some of these work that companies have gone out of business, there's no way to get an update. Nobody really realizes their GPS in there. Because you remember, GPS isn't just used to locate you. GPS is used to locate because it uses very fancy high-resolution timers. And the way it works to locate you is it listens for the satellites to send a clock signal.

Craig 24:24
So each of the clocks will announce what time it is. And because the satellites are different distances from you, you will hear the time at different times. Right? You know, that if someone's yelling at you from across the room, have you here or you see a gunshot and range you will see the gunshot before you hear it. Right. Well, if someone fires that gun, right next to you, you're going to hear it instantly correct. So you know, that the the guy that fired the gun, and it took a second for that Soundwave to reach you, you know, that guy's further away than the guy who fired the gun. And immediately you heard it. Well, that's how GPS works using extremely high precision timers. So another thing people do with GPS signals is they use it to get a clock source. So many computers are using GPS receivers to figure out what time it is. So the systems are reverse traffic that controls bridges, etc, etc. Many of them are sinking their clocks and their timers up to GPS. And when it's an embedded system that hasn't been updated, we could have some serious serious problem couple of real quick things here before we go today. And of course, you'll find these articles and many more up on my website. http://CraigPeterson.com. I have also been doing a special podcast called It's A Security Thing, you're not going to find it unless you look for me because I haven't split it out yet. But in it, I'm talking about these types of security issues, things in the real world. This week. I was talking about a CPA firm what they did to respond to a cybersecurity event two weeks ago this happened, what they did right what they did wrong and you will find all kinds of these things are posting them almost daily. Now at my website, there's a special section, http://CraigPeterson.com. So make sure you have a look at it. We are writing all of these articles ourselves. These are not references to other articles. There might be links to other articles, but these are really great. If you're interested in cybersecurity and finding out more you'll find them on my home page again, http://CraigPeterson.com and it's all small businesses. It's all things that did right things that did wrong and what happened and they're all very, very current. So check it out. You really really should and wearing sending include some of those also in my weekly email. If you're not a subscriber /http://CraigPeterson.com/subscribe. Apple is crushing it on resale value in their laptops. But also the iPhones they destroy the Android iPhone X versus a Samsung Galaxy S9 Wow, iPhone X was 1000 bucks when it debuted, it's still worth 700 9 months later. So that's a drop of 30% the Samsung Galaxy S9 costs 720 but it was worth just $290 and drop 60%. So consider that too. When you're looking at the prices of devices what you should be mine and by the way, you should be buying the iPhone. Hey, have a great week. Make sure you check us out online. http://CraigPeterson.com. Take care everybody and we'll be chatting again next week. Bye-bye.

--- 

Related articles:

'Gps Systems Will Be Struck By Y2K-Like Bug On April 6': Security Expert Says He Will Not Fly On 'Day Zero' After Governments Warn Global Devices Will Reset Due To Calendar Glitch

Google Recommends Windows 7 Users To Upgrade To Windows 10 If Possible, As A Kernel Vulnerability Allows For Local Privilege Escalation On The Operating System.

No Guns Or Lockpicks Needed To Steal Modern Cars If They're Fitted With Hackable 'Smart' Alarms

Sextortion Scammers Target Employees

Google Has Quietly Added Duckduckgo As A Search Engine Option For Chrome Users - Privacy

iPhone Crushes Androids On Resale Value

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

It's Friday. Time for another Security thing. Today, Craig discusses sim hijacking, how to protect yourself from it by hardening your cell phone against these sim hijackers.

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles 

---

Below is a rush transcript of this segment, it might contain errors.

Airing date: 03/15/2019

Sim Swaps - Hardening Your Cell Phone Against Sim Hijacks

Craig Peterson 0:00
Hey, good morning, everybody. Craig Peterson here with another Security Thing.

Craig 0:13
And this morning, we are going to be talking about a guy out again, this is also I think it's in California. Yes, it is California. And this happened just last month, in fact, sentencing March 14, 2019, and this is what's called sim jacking. And it's being used more and more. You know, we are conscious, many of us that our personal information is out there that we really should be keeping an eye on it. We really should be making sure that our personal information is protected. So what do we do? Well, we put new passwords up, user accounts. We're using 1Password, we're using Lastpass. But there is a big vulnerability for many people.

Craig 1:05
Some websites support two factor authentication, also known as 2FA, and that's a wonderful thing. But the problem is, many of them only support a type of two factor authentication that uses your cell phone to identify you. They send a text message and SMS message to identify you and who you are. So you will go on to the website and you'll enter your username, your password, and then it'll say, okay, we just sent a code to your cell phone. What's that code.

Craig 1:41
Now, there are much better ways of doing this with two factor authentication. We use USB keys, we use something called Duo on our phones.

Craig 1:51
So a special message comes through to our phone to an application on her phone that pops up, we have to authorize it. We have biometrics turned on as well, so that it's a lot safer. But we're handling other people's data, right, our customers data, then if you're handling customer data, or employee data, you should be doing something similar.

Craig 2:12
Well, in this case, Joel Ortiz was doing something known as a sim swap. And he was able to use to steal $5 million from people there at the school and elsewhere.

Craig 2:28
What he did is he stole the phone numbers of people that had cryptocurrency accounts.

Craig 2:39
How do you do that? Well, it's actually pretty simple. If people's accounts aren't set up properly, all you have to do is call the carrier, you know, AT&T, Verizon, T Mobile, whoever might be, called the carrier, pretend to be the person and do what's known as a port out, you know, how you can change your mobile phone company and still have the same phone number that is called porting your number and a port out is where you call your current provider and say, I'm moving my number out of your service and into another service that's a port out. So what he did is he had 40 victims.

Craig 3:24
He called up their phone companies and said, Hey, I'm moving to a new carrier, he provided the sim number for the new phone he wanted to port it to, and they, of course, just went ahead and move the phone number over for him. And you can do it quite simply, you don't have to change carriers, you can just say I have a new phone, I have a new SIM card and they will port your phone number to that new SIM card.

Craig 3:50
Then what the guy did is he went online to the crypto repository, if you will, where this Bitcoin is cryptocurrency was stored and he tried to log in, recover my password, they sent the reset to the phone number, which he had control over. And he used that to steal about $5 million in cryptocurrency.

Craig 4:15
So he's getting 10 years in prison, but it doesn't have to be cryptocurrency. This sim hijacking is being used for all kinds of fraud.

Craig 4:27
So here's what you need to do. To prevent this. First off, you need to harden your account with your mobile phone provider. Make sure you turn on something like a pin and that you have on your  account. AT&T lets you add a pass code to your account at AT&T. Verizon is now requiring every customer to have a pin or password as a primary authentication method. Because remember, they can call using your caller ID even before they do the port out. The SIM hijacking T Mobile has what they call a port validation feature. It's a pass code separate from the usual pass code. Sprint offers a separate pin you can use. So take a minute, do it right now call your cell phone provider directly.

Craig 5:20
Explain that you're worried about criminals taking over your phone number and ask about whatever kind of increased security they might have to protect your account. And then the second thing to do is never link your cell number to your online accounts. Now, I know in many cases, it's impossible not to. They require your cell number. I'm thinking about PayPal here right off the top of my head. And that's always bothered me. They don't have good two factor authentication. All these not that I could find going online. If you know about it, let me know. Send me a note in text me 855-385-5553 and let me know.

Craig 6:01
But take a minute remove your phone number from any account that could interest hackers. And you know, PayPal is one of those isn't it.

Craig 6:09
Use something like Google Voice which is a voice number that is sim hijack proof because there is no sim associated with it.

Craig 6:21
That's what I've gone to. I'm using a voip number for the verification number. So you obviously have to protect a number using unique password two factor authentication. Making sure doesn't expire if you don't use it regularly. But there are a lot of steps that you can take a look at your Gmail, Microsoft, Apple, Twitter, Instagram, Facebook and Amazon account. Anything else that you have, go into your security settings, and try and use something like Google Authenticator or do oh as I mentioned do Oh, do you Oh, is something that we use here for my business to protect our information and our customers in formation and if you'd like to know more, let me know maybe we'll put together a master class for you guys little free class but you gotta let me know if this is something you think I should do 855-385-5553

Craig 7:14
Just text me right there and let me know or just email [email protected]. Let me know that you'd be interested in learning more maybe some step by step to stop sim hijacking on your accounts. All right. Take care of the body. We will be back tomorrow with a full radio show my half hour show the turd on terrestrial radio in New Hampshire, Maine, Vermont, and also Massachusetts.

Craig 7:44
So take care and of course it's here on podcasts as well. Bye bye.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Message Input:

Message #techtalk

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

It's Friday. Time for another Security thing. Today, Craig discusses sim hijacking, how to protect yourself from it by hardening your cell phone against these sim hijackers.

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles 

---

Below is a rush transcript of this segment, it might contain errors.

Airing date: 03/15/2019

Sim Swaps - Hardening Your Cell Phone Against Sim Hijacks

Craig Peterson 0:00
Hey, good morning, everybody. Craig Peterson here with another Security Thing.

Craig 0:13
And this morning, we are going to be talking about a guy out again, this is also I think it's in California. Yes, it is California. And this happened just last month, in fact, sentencing March 14, 2019, and this is what's called sim jacking. And it's being used more and more. You know, we are conscious, many of us that our personal information is out there that we really should be keeping an eye on it. We really should be making sure that our personal information is protected. So what do we do? Well, we put new passwords up, user accounts. We're using 1Password, we're using Lastpass. But there is a big vulnerability for many people.

Craig 1:05
Some websites support two factor authentication, also known as 2FA, and that's a wonderful thing. But the problem is, many of them only support a type of two factor authentication that uses your cell phone to identify you. They send a text message and SMS message to identify you and who you are. So you will go on to the website and you'll enter your username, your password, and then it'll say, okay, we just sent a code to your cell phone. What's that code.

Craig 1:41
Now, there are much better ways of doing this with two factor authentication. We use USB keys, we use something called Duo on our phones.

Craig 1:51
So a special message comes through to our phone to an application on her phone that pops up, we have to authorize it. We have biometrics turned on as well, so that it's a lot safer. But we're handling other people's data, right, our customers data, then if you're handling customer data, or employee data, you should be doing something similar.

Craig 2:12
Well, in this case, Joel Ortiz was doing something known as a sim swap. And he was able to use to steal $5 million from people there at the school and elsewhere.

Craig 2:28
What he did is he stole the phone numbers of people that had cryptocurrency accounts.

Craig 2:39
How do you do that? Well, it's actually pretty simple. If people's accounts aren't set up properly, all you have to do is call the carrier, you know, AT&T, Verizon, T Mobile, whoever might be, called the carrier, pretend to be the person and do what's known as a port out, you know, how you can change your mobile phone company and still have the same phone number that is called porting your number and a port out is where you call your current provider and say, I'm moving my number out of your service and into another service that's a port out. So what he did is he had 40 victims.

Craig 3:24
He called up their phone companies and said, Hey, I'm moving to a new carrier, he provided the sim number for the new phone he wanted to port it to, and they, of course, just went ahead and move the phone number over for him. And you can do it quite simply, you don't have to change carriers, you can just say I have a new phone, I have a new SIM card and they will port your phone number to that new SIM card.

Craig 3:50
Then what the guy did is he went online to the crypto repository, if you will, where this Bitcoin is cryptocurrency was stored and he tried to log in, recover my password, they sent the reset to the phone number, which he had control over. And he used that to steal about $5 million in cryptocurrency.

Craig 4:15
So he's getting 10 years in prison, but it doesn't have to be cryptocurrency. This sim hijacking is being used for all kinds of fraud.

Craig 4:27
So here's what you need to do. To prevent this. First off, you need to harden your account with your mobile phone provider. Make sure you turn on something like a pin and that you have on your  account. AT&T lets you add a pass code to your account at AT&T. Verizon is now requiring every customer to have a pin or password as a primary authentication method. Because remember, they can call using your caller ID even before they do the port out. The SIM hijacking T Mobile has what they call a port validation feature. It's a pass code separate from the usual pass code. Sprint offers a separate pin you can use. So take a minute, do it right now call your cell phone provider directly.

Craig 5:20
Explain that you're worried about criminals taking over your phone number and ask about whatever kind of increased security they might have to protect your account. And then the second thing to do is never link your cell number to your online accounts. Now, I know in many cases, it's impossible not to. They require your cell number. I'm thinking about PayPal here right off the top of my head. And that's always bothered me. They don't have good two factor authentication. All these not that I could find going online. If you know about it, let me know. Send me a note in text me 855-385-5553 and let me know.

Craig 6:01
But take a minute remove your phone number from any account that could interest hackers. And you know, PayPal is one of those isn't it.

Craig 6:09
Use something like Google Voice which is a voice number that is sim hijack proof because there is no sim associated with it.

Craig 6:21
That's what I've gone to. I'm using a voip number for the verification number. So you obviously have to protect a number using unique password two factor authentication. Making sure doesn't expire if you don't use it regularly. But there are a lot of steps that you can take a look at your Gmail, Microsoft, Apple, Twitter, Instagram, Facebook and Amazon account. Anything else that you have, go into your security settings, and try and use something like Google Authenticator or do oh as I mentioned do Oh, do you Oh, is something that we use here for my business to protect our information and our customers in formation and if you'd like to know more, let me know maybe we'll put together a master class for you guys little free class but you gotta let me know if this is something you think I should do 855-385-5553

Craig 7:14
Just text me right there and let me know or just email [email protected]. Let me know that you'd be interested in learning more maybe some step by step to stop sim hijacking on your accounts. All right. Take care of the body. We will be back tomorrow with a full radio show my half hour show the turd on terrestrial radio in New Hampshire, Maine, Vermont, and also Massachusetts.

Craig 7:44
So take care and of course it's here on podcasts as well. Bye bye.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Message Input:

Message #techtalk

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553