Craig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity

Welcome!

Craig discusses problems related to Mail-in Voting and Voting technology.

For more tech tips, news, and updates visit - CraigPeterson.com

---

Read More:

Patch Tuesday (September 2020): Microsoft Addresses 129 Vulnerabilities

Ransomware accounted for 41% of all cyber insurance claims in H1 2020

A bevy of new features make iOS 14 the most secure mobile OS ever

Don't Fall for It! Defending Against Deepfakes

Patient dies after a ransomware attack reroutes her to a remote hospital

Lock your doors, people: Verizon breach on unsecured AWS server exposes 14M customer records

Time for CEOs to Stop Enabling China's Blatant IP Theft

Newly Patched Amazon Alexa Flaws -- A Red Flag for Home Workers

---

Automated Machine-Generated Transcript:

Craig Peterson: [00:00:00] Red team-blue team. This is a very interesting problem that is now being confirmed. Through a study. A bipartisan study. We are in trouble with our election this year.

Hey everybody. Craig Peterson here. Thanks for joining us.

Man alive! can anything be more political than a presidential election cycle? It is as. Downloading what has been happening when what's being said right now. There are a number of studies that have looked into the efficacy, the ability to have a fair election where we really know the results. There've been all kinds of suggestions.

We've talked on the show before. About well, we could have, an app that we use to vote. We saw what happened with the Democrat primary in Iowa, right? Total mess. We saw what happened with this app called Vote. I don't know if you heard about this, but this is another voting company. There were some security assessments done and votes criticize the researchers and their methods.

The security issues that were uncovered with the votes application, we've actually confirmed a security company called Trail of Bits in March this year. Some serious problems.  At the USENIX security conference that just occurred here, about a week ago. Okay. They had a panel of voting experts and they got together and they talked about election security.

They in fact had a couple of sessions at the Usenix security conference that was covering the voting systems and technology. We've talked before about the black hat. Conference and how they set up these voting machines and just see if they could be he hacked. There was like a 12-year old hacked a voting machine that just so simple for so many of these machines out there.

The biggest problem with the voting machines is you don't have a physical audit trail in many cases. What did they do? They added some audit trails to some of them. They have a thermal printer. have you ever taken the receipt from the grocery store, stuck it in your pocket, and left it there for a couple of weeks and it becomes illegible or heaven forbid, it gets too warm? Maybe it is stuck in a hot room or a storage room or a car.  It turns completely black.

What good is that sort of thing going to do? All you have is a whole bunch of lines, one at a time about what the votes were. Very hard to tabulate. It's not like the cards that you can use to vote on which many States in new England Jews and frankly, our country right wide right now.

But those cards. You can sit there and analyze them. You might've seen a video of what happened in the Florida election and holding these punch cards up to try and figure out. Is this a hanging Chad and pregnant? Chad was a punched. Was it not Punched? Was this intentional? Did they mean to do that instead?

All of this craziness with the cards. Let's say the question is about the president and who was voted for, was it Joe Biden or was it, Donald Trump, and all they have to do is look at the card. Okay. there's partisan left, a partisan right, maybe a neutral observer standing there. They say this is clearly Joe Biden. So they put it in the Joe Biden pile next. Who is this? that's clearly President Trump, so we'll put it in the Donald Trump pile. Then when you're done, you just count them in the pile versus these audit trails. Yeah. They're audit trails. But how do you do that when it's a paper tape?

How do you do that? If it's been written into a database? How do you know that database wasn't altered? Yeah. Yeah. Okay. there's, there are ways to track things in databases and databases having different types of integrity protection, but overall, you can't really trust it.

And these researchers reverse-engineered this votes Android application, and they did a static analysis on this back end server software that was actually tallying the vote and without having access to the source code without having them a massive number of people who are trying to analyze the system as Russia does.

Russia has its hands on some of our voting equipment. It's easy enough to buy online and pretends you're someone you aren't. So they were doing this blind, the security researchers, and they found five high severity vulnerabilities and a serious privacy issue.

That's using one of these apps from a company that does voting. And we've talked about some of the different voting systems out there from Diebold and many others that have various types of problems. Really. The only way to know if a vote is valid. Is to have a, I like the card ID where you fill in the little circle and then that gets run through a voting machine and it's all overseen by, hopefully, independent people, but I don't care if they're partisan one way or the other and that machine tallies it and keeps the card.

So you can now go back and do a spot analysis on it, or you can do deep analysis on it. I think all of that sort of thing makes sense.

But that's not what we're talking about this year. We're talking about having a presidential election where people are mailing in ballots. It just blows my mind. People comparing it somehow to absentee ballots and absentee voting.

It is not the same thing. And here's why. If you want an absentee ballot, you go to the town clerk or the election official. And you swear out in front of them that you need an absentee ballot. Now in most places that have now been removed that requirement to say, yeah, I'm going to be out of town out of the country. Eh, whatever the reason is, I'm not going to be able to vote on that day to this year. I think it's November 3rd and therefore needed an absentee ballot. Okay. So that's step one. And that's been removed in almost all cases.

 I don't have a particular problem with that. Although I would much rather see someone showing up to vote on voting day, which by the way is required by the constitution. I have no idea how this early voting stuff has happened, how it could possibly be constitutional. The vote is November 3rd. It doesn't start on September 1st. It's November 3rd, and that allows the campaigns to get their messaging straight.

It allows the little guys to actually compete with these people who are already serving in office. Anyhow, that's a separate issue.

You have now been standing in front of that clerk's office. And that clerk now brings out the paperwork. what ballot do you want? You might have a partisan ballot, but for the general election, you don't, you have all of the final candidates and now they verify you are who you say you are.

In most cases, that means you present a valid ID. They check the voter rolls and make sure you are eligible to vote and once that's all taken care of, they will hand you the paperwork. Then you can go home. You can vote on that. You sealed it in an envelope, you sign the outside of the envelope across the seal. You follow the instructions. They are not that complicated. And you either drop that back at the clerk's office, which is the safest way to do it, or you mail it and it goes to the clerk's office and it has to be there before the election. And there's some argument that it just has to be stamped by the post office before the end of November 3rd. That's the absentee voting process.

What's happening in many States is they're saying, Oh, all you have to do now is look in your mailbox because we're sending ballots to everybody that we have a name and address for and then you just fill it out. You send it in. TaDa all done. No verification of who you are.

In some cases like the way Florida has been doing that, there is a verification that they did receive your ballot, but that's kind of it.

And there are more problems. And these are what I'm going to talk about when we get back, what are the real problems? The deep problems when we're talking about these ballots.

We'll get into that. Here are the problems that hackers could use. Very inexpensively, very easy for us to have zero confidence that the vote tally is right.

 So stick around. I'll be right back. You listening to Craig Peterson right here on the radio, on podcasts, and [email protected].

Stick around.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!

Craig discusses the mounting security issues revolving around the upcoming elections.

For more tech tips, news, and updates visit - CraigPeterson.com

---

Read More:

Patch Tuesday (September 2020): Microsoft Addresses 129 Vulnerabilities

Ransomware accounted for 41% of all cyber insurance claims in H1 2020

A bevy of new features make iOS 14 the most secure mobile OS ever

Don't Fall for It! Defending Against Deepfakes

Patient dies after a ransomware attack reroutes her to a remote hospital

Lock your doors, people: Verizon breach on unsecured AWS server exposes 14M customer records

Time for CEOs to Stop Enabling China's Blatant IP Theft

Newly Patched Amazon Alexa Flaws -- A Red Flag for Home Workers

---

Automated Machine-Generated Transcript:

Craig Peterson: [00:00:00] Before the break, we were talking about some of the problems with different types of voting, the electronic voting machines, the apps that have been used and developed, and serious problems with those. But now we're going to talk about the problem with the mail.

Hey, you're listening to Craig Peterson. Thanks for joining us today.

A great little study was just performed and I kinda liked it. The way they did some of this stuff. They were looking at the problems we are going to have with the presidential election this year. A lot of States, first of all, don't bother checking your voter ID. They don't bother checking to make sure you are a legal voter. Of course, that's a problem and you might know, I live in New Hampshire, our state sport is voting up here. It is. Politics we're first in the nation when it comes to the primaries and we pay a lot of attention to this. One of the things that are illegal and yet happen every time, every two years there's a vote. This is absolutely illegal, is that these kids are in our schools. Because we have some Ivy League colleges, universities. We have even high schools that have kids in them that are of age to vote. It is illegal for them to vote because they are not New Hampshire residents are just here for school and yet they vote every year.

It really bothers me, right? Because us taxpayers in New Hampshire, are being or election severely influenced by people that have legally no right to vote in New Hampshire. I could tell you all kinds of stories, talking with people that come up from mass to vote in New Hampshire elections that have no residency in New Hampshire. There is so much fraud. It just makes my mind boggle.

So this year, the only, or the problems that people have already been talking about, President Trump has talked about, the Democrats used to talk about with people voting illegally. We are looking at problems of, what happens when a state mails out ballots to pretty much every person in the state.

There have already been complaints in States where there have been ballots showing up for people who haven't lived in a house 15 years. Are you kidding me? Don't you guys purge your voter rolls? If people aren't voting it is absolutely insane. So what happens if a ballot shows up at a house and the person hasn't lived there in 15 years? Is someone going to take that ballot and fudge it for their favorite candidate?

How about these homes that people are living in, right where we've had all these COVID deaths. Many of these people are invalid, unfortunately. So are their caretakers going to take their ballots and vote for them? How do we know that a legitimate voter voted and only voted once? We don't. Okay.

That's a problem that many people have I've been talking about, but I talk about tech here and security behind the tech. One of the big problems that we could have right now. Has been proven by this red team-blue team approach. If you've been in the military, you are probably very familiar with the red team-blue team.

This is where you will have a team of people that are attacking. We have another team that is defending. So that whole concept has been moved into the security realm in cybersecurity. We use it. I got a book on it about what to do, how to do that sort of thing. If you're the attacker, here's how you attack.

If you're the defender, here are some good ways to defend it again. That's why it's so important. If you're trying to defend a network to have a unified integrated defense system so you can see when things are happening. You don't have software from these guys, hardware from those guys, hardware from another party, hardware from yet a fourth party. It's impossible to defend when you have too many disparate data points. It might actually be pointing in different directions, every one of them. So you've gotta be very careful about that.

So they had a red team group of attackers that had security professionals, election experts, and law enforcement from both sides of the political spectrum.

They tried a whole bunch of things. Their goal was to undermine confidence in the election results themselves, as well as reducing election turnout. So we've heard accusations that four years ago, the Russians were meddling in our election. Of course, they were, and it happens every year.

Russians meddle. They really are trying to undermine confidence in it. But the Marxists big time, that's what they want to do. They wanted to divide and conquer. They don't want to have any sort of trust, in any sort of government entity or anybody that has any authority so that they can collapse the system and then take over.

So when we're talking about this red team, trying to do something to the election. It's very difficult for them to get into all of the secretaries of state office computers because all of these secretaries of state have different systems. It's very difficult to break into them. Remember, we do not have a national election at all, ever in the United States.

We have 50 individual state elections. It's designed in such a way the small States have a voice against the big States. That's very important. Unfortunately, they changed some of this here with an amendment to the constitution. Senators were supposed to protect the state and they changed all of that by turning it into a popular election, but that's a separate issue.

You've got this red team and if they can't get into the 50 secretaries of States, individual election systems to modify the results or get into the voting machines to modify the results. What's the next best thing, obviously, you're trying to undermine the faith in elections. In voting. Undermine the faith in the results.

We're already hearing from both sides, that we're not going to trust the results. In fact, just this week, I think it was Wednesday, maybe Tuesday, secretary of state Clinton, Hillary Clinton came out and said, no matter what, if Joe Biden doesn't win, he should never concede. Because there is fraud coming. We know President Trump's been warning about fraud as well.

So we've got to come from both sides. Well, they found, through this study, that they can easily and inexpensively spread misinformation about new outbreaks in the COVID virus and that'll hamper people going out to vote. It's going to hamper the processes of mail-in ballots. And if the aim is undermining faith in the election and not necessarily swinging the vote towards one candidate or the other. It's very easy to do.

So we've got a great quote on my website here. You'll find it on dark reading from Maggie McAlpine. She is a co-founder of Nordic innovation labs and it was one of the red team participants and a cyber reason, by the way, was the company that ran this whole thing. She's saying, Hey, it's quite achievable.

And it's a very inexpensive direct quote here. There is this creeping sense of uneasiness because none of what we did was very expensive. Most of the attacks we proposed don't cost anything. Putting out a tweet that shows a crowded hallway and claiming it's a certain polling place. It's just that easy.

Then on the tech side. Did you know how easy it is to reset the post office sorting machines? Yeah. there's been all of this complaint about machines being removed from post offices, which they have been. That was a process that was started under President Obama. It's been going on for years now.

Did you realize that putting a specific barcode on a piece of mail, dropping it in a mailbox and that mail now goes to the post office that will reset the sorting machines? Yeah, it really is that simple. Then guess what happens? Those ballots do not make it to be counted by the secretaries of state in time.

Hey, you're listening to Craig Peterson, stick around. Cause when we come back, we're going to talk about the corporate office reincarnated.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!

Craig discusses the mounting security issues revolving around the upcoming elections.

For more tech tips, news, and updates visit - CraigPeterson.com

---

Read More:

Patch Tuesday (September 2020): Microsoft Addresses 129 Vulnerabilities

Ransomware accounted for 41% of all cyber insurance claims in H1 2020

A bevy of new features make iOS 14 the most secure mobile OS ever

Don't Fall for It! Defending Against Deepfakes

Patient dies after a ransomware attack reroutes her to a remote hospital

Lock your doors, people: Verizon breach on unsecured AWS server exposes 14M customer records

Time for CEOs to Stop Enabling China's Blatant IP Theft

Newly Patched Amazon Alexa Flaws -- A Red Flag for Home Workers

---

Automated Machine-Generated Transcript:

Craig Peterson: [00:00:00] Before the break, we were talking about some of the problems with different types of voting, the electronic voting machines, the apps that have been used and developed, and serious problems with those. But now we're going to talk about the problem with the mail.

Hey, you're listening to Craig Peterson. Thanks for joining us today.

A great little study was just performed and I kinda liked it. The way they did some of this stuff. They were looking at the problems we are going to have with the presidential election this year. A lot of States, first of all, don't bother checking your voter ID. They don't bother checking to make sure you are a legal voter. Of course, that's a problem and you might know, I live in New Hampshire, our state sport is voting up here. It is. Politics we're first in the nation when it comes to the primaries and we pay a lot of attention to this. One of the things that are illegal and yet happen every time, every two years there's a vote. This is absolutely illegal, is that these kids are in our schools. Because we have some Ivy League colleges, universities. We have even high schools that have kids in them that are of age to vote. It is illegal for them to vote because they are not New Hampshire residents are just here for school and yet they vote every year.

 It really bothers me, right? Because us taxpayers in New Hampshire, are being or election severely influenced by people that have legally no right to vote in New Hampshire.  I could tell you all kinds of stories, talking with people that come up from mass to vote in New Hampshire elections that have no residency in New Hampshire. There is so much fraud. It just makes my mind boggle.

So this year, the only, or the problems that people have already been talking about, President Trump has talked about, the Democrats used to talk about with people voting illegally. We are looking at problems of, what happens when a state mails out ballots to pretty much every person in the state.

There have already been complaints in States where there have been ballots showing up for people who haven't lived in a house 15 years. Are you kidding me? Don't you guys purge your voter rolls? If people aren't voting it is absolutely insane. So what happens if a ballot shows up at a house and the person hasn't lived there in 15 years? Is someone going to take that ballot and fudge it for their favorite candidate?

How about these homes that people are living in, right where we've had all these COVID deaths. Many of these people are invalid, unfortunately. So are their caretakers going to take their ballots and vote for them? How do we know that a legitimate voter voted and only voted once? We don't. Okay.

That's a problem that many people have I've been talking about, but I talk about tech here and security behind the tech. One of the big problems that we could have right now. Has been proven by this red team-blue team approach. If you've been in the military, you are probably very familiar with the red team-blue team.

This is where you will have a team of people that are attacking. We have another team that is defending. So that whole concept has been moved into the security realm in cybersecurity. We use it. I got a book on it about what to do, how to do that sort of thing. If you're the attacker, here's how you attack.

If you're the defender, here are some good ways to defend it again. That's why it's so important. If you're trying to defend a network to have a unified integrated defense system so you can see when things are happening. You don't have software from these guys, hardware from those guys, hardware from another party, hardware from yet a fourth party. It's impossible to defend when you have too many disparate data points. It might actually be pointing in different directions, every one of them. So you've gotta be very careful about that.

So they had a red team group of attackers that had security professionals, election experts, and law enforcement from both sides of the political spectrum.

They tried a whole bunch of things. Their goal was to undermine confidence in the election results themselves, as well as reducing election turnout. So we've heard accusations that four years ago, the Russians were meddling in our election. Of course, they were, and it happens every year.

Russians meddle. They really are trying to undermine confidence in it. But the Marxists big time, that's what they want to do. They wanted to divide and conquer. They don't want to have any sort of trust, in any sort of government entity or anybody that has any authority so that they can collapse the system and then take over.

So when we're talking about this red team, trying to do something to the election. It's very difficult for them to get into all of the secretaries of state office computers because all of these secretaries of state have different systems. It's very difficult to break into them. Remember, we do not have a national election at all, ever in the United States.

We have 50 individual state elections. It's designed in such a way the small States have a voice against the big States. That's very important. Unfortunately, they changed some of this here with an amendment to the constitution. Senators were supposed to protect the state and they changed all of that by turning it into a popular election, but that's a separate issue.

You've got this red team and if they can't get into the 50 secretaries of States, individual election systems to modify the results or get into the voting machines to modify the results. What's the next best thing, obviously, you're trying to undermine the faith in elections. In voting. Undermine the faith in the results.

We're already hearing from both sides, that we're not going to trust the results. In fact, just this week, I think it was Wednesday, maybe Tuesday, secretary of state Clinton, Hillary Clinton came out and said, no matter what, if Joe Biden doesn't win, he should never concede. Because there is fraud coming. We know President Trump's been warning about fraud as well.

So we've got to come from both sides. Well, they found, through this study, that they can easily and inexpensively spread misinformation about new outbreaks in the COVID virus and that'll hamper people going out to vote. It's going to hamper the processes of mail-in ballots. And if the aim is undermining faith in the election and not necessarily swinging the vote towards one candidate or the other. It's very easy to do.

So we've got a great quote on my website here. You'll find it on dark reading from Maggie McAlpine. She is a co-founder of Nordic innovation labs and it was one of the red team participants and a cyber reason, by the way, was the company that ran this whole thing. She's saying, Hey, it's quite achievable.

And it's a very inexpensive direct quote here. There is this creeping sense of uneasiness because none of what we did was very expensive. Most of the attacks we proposed don't cost anything. Putting out a tweet that shows a crowded hallway and claiming it's a certain polling place. It's just that easy.

Then on the tech side. Did you know how easy it is to reset the post office sorting machines? Yeah. there's been all of this complaint about machines being removed from post offices, which they have been. That was a process that was started under President Obama. It's been going on for years now.

Did you realize that putting a specific barcode on a piece of mail, dropping it in a mailbox and that mail now goes to the post office that will reset the sorting machines? Yeah, it really is that simple. Then guess what happens? Those ballots do not make it to be counted by the secretaries of state in time.

Hey, you're listening to Craig Peterson, stick around. Cause when we come back, we're going to talk about the corporate office reincarnated.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!

Craig discusses problems with some of the smart lock technology and an even larger issue surrounding IoT devices in general.

For more tech tips, news, and updates visit - CraigPeterson.com

---

Read More:

Patch Tuesday (September 2020): Microsoft Addresses 129 Vulnerabilities

Ransomware accounted for 41% of all cyber insurance claims in H1 2020

A bevy of new features make iOS 14 the most secure mobile OS ever

Don't Fall for It! Defending Against Deepfakes

Patient dies after a ransomware attack reroutes her to a remote hospital

Lock your doors, people: Verizon breach on unsecured AWS server exposes 14M customer records

Time for CEOs to Stop Enabling China's Blatant IP Theft

Newly Patched Amazon Alexa Flaws -- A Red Flag for Home Workers

---

Automated Machine-Generated Transcript:

Craig Peterson: [00:00:00] Hey, welcome back everybody. If you have smart locks or you think maybe smart locks are the way to go, we've got a little bit of news for you. Some research had just come out about these smart locks in our homes and offices turns out they just smart for their own britches.

Craig Peterson here. Thanks for joining me online. And of course, WGAN where we air every Saturday from one till three, you can always join us there. I'd love for you to tune in. And of course, we're also on, yeah, you guessed it. Tune in as well as any pretty much any other podcast app out there.

Now, let's get a little bit into this whole smart lock thing. We've been talking a fair amount about the whole problem with IoT on the show. If you miss some of the earlier stuff, I think it's important to go back to particularly if you are a business person or you're working from home and VPNing into a business.

I covered quite a bit of that stuff just today, in fact, but you can always find it out on my [email protected] for a review. What we're going to talk about right now? Isn't like the Alexa or the Google home. Although in both cases they do have smart locks and tie into them. Oh, it's just so convenient to tell Alexa to turn on the chicken coop lights or turn them off or open the front door, et cetera.

There are also other types of locks that I think are really cool where it's a proximity lock. It uses your Bluetooth phone ID. That ID is typically something that is merely a, are basically like a Mac address there on your Bluetooth device.

There are other ones that are being built into cars, including Teslas and now BMWs that use an app on your phone in order to unlock the door, cool all the way around.

But behind all of these is some technology that is not only unproven but according to grand view research, this is still a bit of a problem. We're looking at a global, smart lock market valued at $1.2 billion. Last year over 7 million devices sold last year and they are expecting this market to grow pretty dramatically over the next five to 10 years. But there are two recently published reports about smart lock vulnerabilities that are very concerning.

This is another article out of dark reading our friends over there. First of all the UTEC ultra lock. Now they have hit the news before this is a smart lock project. It began as an Indiegogo campaign. If you're not familiar with them, it's where people get to you, invest in a project. If the project comes to fruition they go ahead and they get one of the products. That's usually how those types of things work. It's a way for people to invest a couple of bucks on something that they really believe in.

So this guy came up with this ultra lock and the idea and the group put it together and they put it up on IndieGoGo to try and raise some money to build these new types of smart locks that they had.

Tripwire, which is a security research company among other things said that they came across this flaw late last year, the researcher's name is Craig Young. And he was looking into this, the protocol that's being used by a lot of these smart devices, It's called MQTT, which is message queuing, telemetry transport.

You can think of it as an SNMP if you are a little bit more techie. Which is the simple network management protocol, but lighter weight because the internet of things, devices just don't have enough memory and CPU and everything else to run big operating systems. Now I have a problem with that.

The manufacturers saying, we've got to go with this lightweight protocol, man. We're just a door lock. how can you expect us to do anything more? It turns out that a lot of these companies are not using authentication that's verifiable. They are not using encryption and they're not using any sort of real authorization scheme.

So what's happened here is he has proven that pretty much any unauthorized user, that can see one of these messages in transit port and get access that broker can easily guess the names of that are used the topic names. Now in SNMP, you have the MIPS. There are security parameters that you can use, but in this case, all you have to do if you can get access to that, the broker is use the pound sign and the topic name, and now all of a sudden you're obtaining all of the data that's going through that data broker.

This is a very. Big problem. So he looked at several pages of these protocols, topic names, and he kept finding references to LOC and free email providers. Like g-mail dot com that some of these companies are using, if you can believe that.

So he said, I query the server myself with Linux command, align tools, and I was instantly inundated with personally identifiable information, apparently from all over the world. He said that it included email addresses, IP addresses associated with the logs, timestamp records of when and where they opened and closed all of it.

Now there is thinking out there that really this protocol can be perfectly safe. But the problem again is these companies that are making them are not hiring professional programmers that understand the risks because it could have been secured. They should be using access controls. They should be using authentication. They should be using encryption. In this case with UTEC, it used none of those things. None of them. so again, don't just blame it on China, although they certainly take shortcuts. Most of these companies here in the US are taking shortcuts too.

We don't have any real programmers coming out of schools now it's all drag and drop. Yeah. Yeah. You just drag this visual basic, visual C-sharp thing, whatever it might be. There's this Java module and magic happens. Without them knowing what's really going on behind the scene. There's another one too, about the August smart lock. This is out of Bitdefender now a bit defender has software that I recommend a lot of people use.

It is not a panacea. It is not the ultimate. But bit defender, particularly their paid version usually does help with your security. So a little tip there for those of us on either a Mac or a windows computer. Check out Bitdefender, you might want to use it, not as good again as the commercial stuff, the real stuff for real businesses.

But they said, yes, they documented in detail, a vulnerability. The bit defender had found with the August smart lock also late last year and the Bitdefender guys were working with PC mag and they were evaluating smart device security. So Bitdefender is saying that their team does discover that while this August smart lock.

It could communicate with the smartphone in over an encrypted channel. The encryption key itself is hardcoded into the app. So it allows an attacker within range to use, drop an intercept, the wifi password it's really that simple. So there you go. There's an example. Of a smartphone using wifi to talk to the lock and yeah. Yeah. We're encrypted.

So again, it goes back to pencil whipping forms is your smart lock encrypted? Oh yeah, we are encrypted. And then that's where the conversation ends in the audit check purchasing manager just checks it there on the form. it's almost completely useless when it's programmed this way. Almost completely useless. So again, this is. Obviously specific to this device and when the device is being set up a real vulnerability, but you know what you could, if you want them to install another one of those devices, all you have to do is install a little monitor, hide it there in the bushes or something, and burn out the lock that's there or smasher or whatever you want to do so that it has to be replaced and when the guy replaces it. TaDa you have access to it. It's obviously not that difficult.

Now, someone overseas isn't going to be able to get at it. But someone that is really determined to get into your house could get into it pretty easily. It reminds me of a lot of these door lock systems that are still used in cars today that can be replicated.

You just sit there in the parking lot at a shopping mall and you have a receiver that's listening for that little. Click on the remote control right in the car goes, beep yeah, I'm locked.

Many of those, in fact, almost all of the older ones, can then be duplicated so that all the guy has to do is okay, great, he just locked up that old or BMW. It's only worth $30,000 today, but you know what the heck? And he can replicate it and get that car to unlock itself.

So we have to be a lot more careful with this stuff. Absolutely, a lot more careful. I am very upset with the vendors that do this sort of thing. They are fooling people. They are scamming people by again, pencil whipping forms that poor guy/ gal who's working in purchasing who bought it, who had no idea that, the checkbox was checked, is now in trouble because that device was hacked.

That's just an example of two obvious problems with smart locks. It's a really sad fact of life. That many companies don't have real security people who can look into this and look into a little bit more.

All right. When we come back, we got more, we're going to talk about facial recognition and what the cops are doing right now with not just protesters, obviously, but rioters and how they're using it to arrest people.

You're listening to Craig Peterson here on WGAN and of course, I am on every Wednesday morning at seven 30 with Matt, Gagnon.

Stick around. We'll be right back.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!

Craig discusses problems with some of the smart lock technology and an even larger issue surrounding IoT devices in general. 

For more tech tips, news, and updates visit - CraigPeterson.com

---

Read More:

Patch Tuesday (September 2020): Microsoft Addresses 129 Vulnerabilities

Ransomware accounted for 41% of all cyber insurance claims in H1 2020

A bevy of new features make iOS 14 the most secure mobile OS ever

Don't Fall for It! Defending Against Deepfakes

Patient dies after a ransomware attack reroutes her to a remote hospital

Lock your doors, people: Verizon breach on unsecured AWS server exposes 14M customer records

Time for CEOs to Stop Enabling China's Blatant IP Theft

Newly Patched Amazon Alexa Flaws -- A Red Flag for Home Workers

---

Automated Machine-Generated Transcript:

Craig Peterson: [00:00:00] Hey, welcome back everybody. If you have smart locks or you think maybe smart locks are the way to go, we've got a little bit of news for you. Some research had just come out about these smart locks in our homes and offices turns out they just smart for their own britches.

Craig Peterson here. Thanks for joining me online. And of course, WGAN where we air every Saturday from one till three, you can always join us there. I'd love for you to tune in. And of course, we're also on, yeah, you guessed it. Tune in as well as any pretty much any other podcast app out there.

Now, let's get a little bit into this whole smart lock thing. We've been talking a fair amount about the whole problem with IoT on the show. If you miss some of the earlier stuff, I think it's important to go back to particularly if you are a business person or you're working from home and VPNing into a business.

I covered quite a bit of that stuff just today, in fact, but you can always find it out on my [email protected] for a review. What we're going to talk about right now? Isn't like the Alexa or the Google home. Although in both cases they do have smart locks and tie into them. Oh, it's just so convenient to tell Alexa to turn on the chicken coop lights or turn them off or open the front door, et cetera.

There are also other types of locks that I think are really cool where it's a proximity lock. It uses your Bluetooth phone ID. That ID is typically something that is merely a, are basically like a Mac address there on your Bluetooth device.

There are other ones that are being built into cars, including Teslas and now BMWs that use an app on your phone in order to unlock the door, cool all the way around.

But behind all of these is some technology that is not only unproven but according to grand view research, this is still a bit of a problem. We're looking at a global, smart lock market valued at $1.2 billion. Last year over 7 million devices sold last year and they are expecting this market to grow pretty dramatically over the next five to 10 years. But there are two recently published reports about smart lock vulnerabilities that are very concerning.

This is another article out of dark reading our friends over there. First of all the UTEC ultra lock. Now they have hit the news before this is a smart lock project. It began as an Indiegogo campaign. If you're not familiar with them, it's where people get to you, invest in a project. If the project comes to fruition they go ahead and they get one of the products. That's usually how those types of things work. It's a way for people to invest a couple of bucks on something that they really believe in.

So this guy came up with this ultra lock and the idea and the group put it together and they put it up on IndieGoGo to try and raise some money to build these new types of smart locks that they had.

Tripwire, which is a security research company among other things said that they came across this flaw late last year, the researcher's name is Craig Young. And he was looking into this, the protocol that's being used by a lot of these smart devices, It's called MQTT, which is message queuing, telemetry transport.

You can think of it as an SNMP if you are a little bit more techie. Which is the simple network management protocol, but lighter weight because the internet of things, devices just don't have enough memory and CPU and everything else to run big operating systems. Now I have a problem with that.

The manufacturers saying, we've got to go with this lightweight protocol, man. We're just a door lock. how can you expect us to do anything more? It turns out that a lot of these companies are not using authentication that's verifiable. They are not using encryption and they're not using any sort of real authorization scheme.

So what's happened here is he has proven that pretty much any unauthorized user, that can see one of these messages in transit port and get access that broker can easily guess the names of that are used the topic names. Now in SNMP, you have the MIPS. There are security parameters that you can use, but in this case, all you have to do if you can get access to that, the broker is use the pound sign and the topic name, and now all of a sudden you're obtaining all of the data that's going through that data broker.

This is a very. Big problem. So he looked at several pages of these protocols, topic names, and he kept finding references to LOC and free email providers. Like g-mail dot com that some of these companies are using, if you can believe that.

So he said, I query the server myself with Linux command, align tools, and I was instantly inundated with personally identifiable information, apparently from all over the world. He said that it included email addresses, IP addresses associated with the logs, timestamp records of when and where they opened and closed all of it.

Now there is thinking out there that really this protocol can be perfectly safe. But the problem again is these companies that are making them are not hiring professional programmers that understand the risks because it could have been secured. They should be using access controls. They should be using authentication. They should be using encryption.  In this case with UTEC, it used none of those things. None of them. so again, don't just blame it on China, although they certainly take shortcuts. Most of these companies here in the US are taking shortcuts too. 

We don't have any real programmers coming out of schools now it's all drag and drop. Yeah. Yeah. You just drag this visual basic, visual C-sharp thing, whatever it might be. There's this Java module and magic happens. Without them knowing what's really going on behind the scene. There's another one too, about the August smart lock.  This is out of Bitdefender now a bit defender has software that I recommend a lot of people use.

It is not a panacea. It is not the ultimate. But bit defender, particularly their paid version usually does help with your security. So a little tip there for those of us on either a Mac or a windows computer. Check out Bitdefender, you might want to use it, not as good again as the commercial stuff, the real stuff for real businesses.

But they said, yes, they documented in detail, a vulnerability. The bit defender had found with the August smart lock also late last year and the Bitdefender guys were working with PC mag and they were evaluating smart device security. So Bitdefender is saying that their team does discover that while this August smart lock.

It could communicate with the smartphone in over an encrypted channel. The encryption key itself is hardcoded into the app. So it allows an attacker within range to use, drop an intercept, the wifi password it's really that simple. So there you go. There's an example. Of a smartphone using wifi to talk to the lock and yeah. Yeah. We're encrypted.

So again, it goes back to pencil whipping forms is your smart lock encrypted? Oh yeah, we are encrypted. And then that's where the conversation ends in the audit check purchasing manager just checks it there on the form. it's almost completely useless when it's programmed this way. Almost completely useless. So again, this is. Obviously specific to this device and when the device is being set up a real vulnerability, but you know what you could, if you want them to install another one of those devices, all you have to do is install a little monitor, hide it there in the bushes or something, and burn out the lock that's there or smasher or whatever you want to do so that it has to be replaced and when the guy replaces it. TaDa you have access to it. It's obviously not that difficult.

Now, someone overseas isn't going to be able to get at it. But someone that is really determined to get into your house could get into it pretty easily. It reminds me of a lot of these door lock systems that are still used in cars today that can be replicated.

You just sit there in the parking lot at a shopping mall and you have a receiver that's listening for that little. Click on the remote control right in the car goes, beep yeah, I'm locked.

Many of those, in fact, almost all of the older ones, can then be duplicated so that all the guy has to do is okay, great, he just locked up that old or BMW. It's only worth $30,000 today, but you know what the heck? And he can replicate it and get that car to unlock itself.

So we have to be a lot more careful with this stuff. Absolutely, a lot more careful. I am very upset with the vendors that do this sort of thing. They are fooling people. They are scamming people by again, pencil whipping forms that poor guy/ gal who's working in purchasing who bought it, who had no idea that, the checkbox was checked, is now in trouble because that device was hacked.

That's just an example of two obvious problems with smart locks. It's a really sad fact of life. That many companies don't have real security people who can look into this and look into a little bit more.

All right. When we come back, we got more, we're going to talk about facial recognition and what the cops are doing right now with not just protesters, obviously, but rioters and how they're using it to arrest people.

You're listening to Craig Peterson here on WGAN and of course, I am on every Wednesday morning at seven 30 with Matt, Gagnon.

 Stick around. We'll be right back.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!

Craig discusses how Police are using Facial Recognition to identify and trace movements of rioters.

For more tech tips, news, and updates visit - CraigPeterson.com

---

Read More:

Patch Tuesday (September 2020): Microsoft Addresses 129 Vulnerabilities

Ransomware accounted for 41% of all cyber insurance claims in H1 2020

A bevy of new features make iOS 14 the most secure mobile OS ever

Don't Fall for It! Defending Against Deepfakes

Patient dies after a ransomware attack reroutes her to a remote hospital

Lock your doors, people: Verizon breach on unsecured AWS server exposes 14M customer records

Time for CEOs to Stop Enabling China's Blatant IP Theft

Newly Patched Amazon Alexa Flaws -- A Red Flag for Home Workers

---

Automated Machine-Generated Transcript:

Craig Peterson: [00:00:00] Facial recognition software is getting better all the time. You've seen these rioters and they're wearing all of the masks and hoods and helmets and everything to try and hide their identity. It isn't working anymore.

Craig Peterson: [00:00:20] Hey everybody, Craig Peterson here. Thanks for joining me here on WGAN and online. Of course, Craig peterson.com. If you would take a minute. let me know what you like about the show. Some things you don't like. I've had some great comments for people telling me about when they listen, where they listen, all of that stuff really helps me out. Also what it is, you like the best or you like the worst. Okay.

Make sure also you take a minute. This is for your advantage in a very big way that is making sure you get my newsletter. I have every week articles in there for you. I am starting up here in a couple of weeks. I'm going to have a couple of midweek articles to delving into a security topic, trying to help you out with some of that stuff. So you'll probably hear from me about three times a week. Those ones during the week should only take you a few minutes to go through and it's going to be what's happening now right now.

Trying to keep you up to date on that in the past, that's been something that has been reserved for my navigating cybersecurity masterclass. But, we're going to be releasing some of that for everybody out there. Cause I think it's just that important. All available for free and all of it. When you sign up at Craig peterson.com/subscribe, and I'll also be sending you. Three. Very cool, special reports. Things. I think you'll really like it, and one of them is about your security reboot. So all of that, you'll get to sign up. Craig Peterson.com/subscribe.

We've had some really interesting technology we've talked about on the show and then I've had some CEOs on talking about this tech, where it is being used to spy and track criminals. This particular track I'm thinking of right now was probably still is out there. I, in fact, I know it is. An airplane. It's just a small plane, like a Cessna and that plane flies over big cities and things like New York and Chicago and Los Angeles. Although in LA, they have helicopters all over the place being run by the police departments. This plane is up there with a super high-resolution video camera that is recording everything going on.

The idea behind this is if a crime is committed. They can play that video backward and track the people who committed the crime, hopefully back to where they started from. So they can track them all the way back to their home. Maybe their business, maybe some park that they met at, and then from that park, they can track them back.

It has days and days worth of data. So if you're out on the streets, you're walking around. The camera's picking you up from that airplane. If you are driving around the camera's picking you up on that airplane, I think that's really cool technology. The supposition here, and the Supreme court has held this up, is that if you are out in public, you have no reasonable expectations of privacy. So that was a number of years back.

Now, of course, they've been adding more and more video cameras. There's a lot of questions here in Maine. There've been a lot of discussions about it. Matt has talked about it before on his show. Should we be putting up these video cameras? Is it the right thing to do.

Some police departments have video cameras on all four corners of their squad cars. As they're driving down the street, just normally doing whatever it is they're doing, observing what's going on. Those squad cars are streaming that video Live to a computer system. That's looking up every license plate that has seen now, the police car also has GPS information. So now your cars tracked. If it sees it, if it picks it up and sees the license plate number, it is now logged, and it's fairly permanent. Although police departments seem to be having problems lately keeping the data, that's a separate issue. And if there is a warrant on the owner of the car, so guess what they have to do, they have a license plate number.

They have to look it up. They have to see who the owner is, then they run that through their local database or maybe the NTIC or something else to try and see. If there is a want or warrant out for the owner of the vehicle and they may impound the vehicle, then they may wait there for you to return.

There's a lot of things they can do. In fact, the tow truck operators, many of them have that same system on their trucks. They drive around parking lots over at malls. Looking for cars that maybe they're behind on the payments and they can't find the car, they have to go pick it up. Maybe that car is something that there's a lot of parking tickets on.

And so they get paid for doing that fine, that storage fee that you pay, that's going into the pockets of. It was some of these tow truck operators. It reminds me of a thing that happened to a friend of mine with his car getting towed and the tow truck operators had going kind of crazy jumping on his car and everything else. It was just a bit of a mess.

Anyhow, all of this type of surveillance. I personally think is bad. I think it's wrong. It is too easy to be misused. It is too easy for it to be stolen and then it's in the hands of it, who, which bad guys, right?

Wouldn't it be cool if you're a bad guy in, okay, I'm going to break into this home and it's going to be a burglary, not a robbery cause no one's home and isn't that a wonderful thing and by the way, we're tracking his car here cause we've tapped into? The police system. Or maybe we've into the system of those, tow truck operators.

And we know where his car is, and we'll know when it's on its way home. Because in addition to that, yeah. A lot of these cities have been installed on these cams on traffic lights. Now they know you are going through an intersection and where you went through, what time you went through. Did you wait for that red light? Did you squash it down as the yellow, turned red? It wasn't quite red, yet. This is something else.

Now we're looking at law enforcement dealing with. Violent protesters, right? these fascists who call themselves anti-fascist right. They, these Marxists, they call themselves a the BLM right now. There are legitimate people. There are great people who really care and are really trying to do the right thing. That's not what we're worried about. We're worried about the people that are burning down our businesses, that are causing havoc, that is shooting people that are hitting people over the head with a skateboard or baseball bat.

So the law enforcement in a number of cities now, including New York and Miami. Have been using some facial recognition software to track down and arrest individuals who were participating in criminal activities during these riots. They're doing it after the fact, it's interesting how some of them are doing it.

In some cases like with the fed, they have been tracking them. Watching them while they're in the protests, which is the wrong word is really riots, right? The protest is one thing, burning down buildings, police cars, civilian vehicles, batting people over the head. That's not exactly a protest. What they do is I wait for them to leave the area because you don't want to try and arrest them right in the middle of all of these rioters and they leave the area.

Then they get arrested. Which I think makes a whole lot of sense. Miami pleas are using something called Clearview AI. Now, remember we talked about them a few months ago, maybe six months ago now because this woman allegedly threw a rock at a police officer. Then what they do is they use facial recognition.

Technology not just to surveil them and track them and then arrest them later. They are running it. That's what Clearview does running it through social. Yes, media posts to try and find people. A very interesting problem. Frankly, a New York man air bill DeBlasio promised that the NYPD would be very careful and very limited, and they're not going to arrest it most of these people that are causing bodily harm and destruction of private property. Yeah. Good going mayor DeBlasio. Good. Going a lot of things here. You already know. I don't like Clearview AI, and I don't like the way this technology could be misused by any stretch.

Stick around. We'll be right back listening to Craig Peterson on WGAN and joined me Wednesdays at seven 30 with Matt Gagnon

Stick around. We'll be right back.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!

Craig discusses how Police are using Facial Recognition to identify and trace movements of rioters.

For more tech tips, news, and updates visit - CraigPeterson.com

---

Read More:

Patch Tuesday (September 2020): Microsoft Addresses 129 Vulnerabilities

Ransomware accounted for 41% of all cyber insurance claims in H1 2020

A bevy of new features make iOS 14 the most secure mobile OS ever

Don't Fall for It! Defending Against Deepfakes

Patient dies after a ransomware attack reroutes her to a remote hospital

Lock your doors, people: Verizon breach on unsecured AWS server exposes 14M customer records

Time for CEOs to Stop Enabling China's Blatant IP Theft

Newly Patched Amazon Alexa Flaws -- A Red Flag for Home Workers

---

Automated Machine-Generated Transcript:

Craig Peterson: [00:00:00] Facial recognition software is getting better all the time. You've seen these rioters and they're wearing all of the masks and hoods and helmets and everything to try and hide their identity. It isn't working anymore.

Craig Peterson: [00:00:20] Hey everybody, Craig Peterson here. Thanks for joining me here on WGAN and online. Of course, Craig peterson.com. If you would take a minute. let me know what you like about the show. Some things you don't like. I've had some great comments for people telling me about when they listen, where they listen, all of that stuff really helps me out. Also what it is, you like the best or you like the worst. Okay.

Make sure also you take a minute. This is for your advantage in a very big way that is making sure you get my newsletter. I have every week articles in there for you. I am starting up here in a couple of weeks. I'm going to have a couple of midweek articles to delving into a security topic, trying to help you out with some of that stuff. So you'll probably hear from me about three times a week. Those ones during the week should only take you a few minutes to go through and it's going to be what's happening now right now.

Trying to keep you up to date on that in the past, that's been something that has been reserved for my navigating cybersecurity masterclass. But, we're going to be releasing some of that for everybody out there. Cause I think it's just that important. All available for free and all of it. When you sign up at Craig peterson.com/subscribe, and I'll also be sending you. Three. Very cool, special reports. Things. I think you'll really like it, and one of them is about your security reboot. So all of that, you'll get to sign up. Craig Peterson.com/subscribe.

We've had some really interesting technology we've talked about on the show and then I've had some CEOs on talking about this tech, where it is being used to spy and track criminals. This particular track I'm thinking of right now was probably still is out there. I, in fact, I know it is. An airplane. It's just a small plane, like a Cessna and that plane flies over big cities and things like New York and Chicago and Los Angeles. Although in LA, they have helicopters all over the place being run by the police departments. This plane is up there with a super high-resolution video camera that is recording everything going on.

The idea behind this is if a crime is committed. They can play that video backward and track the people who committed the crime, hopefully back to where they started from. So they can track them all the way back to their home. Maybe their business, maybe some park that they met at, and then from that park, they can track them back.

It has days and days worth of data. So if you're out on the streets, you're walking around. The camera's picking you up from that airplane. If you are driving around the camera's picking you up on that airplane, I think that's really cool technology. The supposition here, and the Supreme court has held this up, is that if you are out in public, you have no reasonable expectations of privacy. So that was a number of years back.

Now, of course, they've been adding more and more video cameras. There's a lot of questions here in Maine. There've been a lot of discussions about it. Matt has talked about it before on his show. Should we be putting up these video cameras? Is it the right thing to do.

Some police departments have video cameras on all four corners of their squad cars. As they're driving down the street, just normally doing whatever it is they're doing, observing what's going on. Those squad cars are streaming that video Live to a computer system. That's looking up every license plate that has seen now, the police car also has GPS information. So now your cars tracked. If it sees it, if it picks it up and sees the license plate number, it is now logged, and it's fairly permanent. Although police departments seem to be having problems lately keeping the data, that's a separate issue. And if there is a warrant on the owner of the car, so guess what they have to do, they have a license plate number.

They have to look it up. They have to see who the owner is, then they run that through their local database or maybe the NTIC or something else to try and see. If there is a want or warrant out for the owner of the vehicle and they may impound the vehicle, then they may wait there for you to return.

There's a lot of things they can do. In fact, the tow truck operators, many of them have that same system on their trucks. They drive around parking lots over at malls. Looking for cars that maybe they're behind on the payments and they can't find the car, they have to go pick it up. Maybe that car is something that there's a lot of parking tickets on.

And so they get paid for doing that fine, that storage fee that you pay, that's going into the pockets of. It was some of these tow truck operators. It reminds me of a thing that happened to a friend of mine with his car getting towed and the tow truck operators had going kind of crazy jumping on his car and everything else. It was just a bit of a mess.

Anyhow, all of this type of surveillance. I personally think is bad. I think it's wrong. It is too easy to be misused. It is too easy for it to be stolen and then it's in the hands of it, who, which bad guys, right?

Wouldn't it be cool if you're a bad guy in, okay, I'm going to break into this home and it's going to be a burglary, not a robbery cause no one's home and isn't that a wonderful thing and by the way, we're tracking his car here cause we've tapped into? The police system. Or maybe we've into the system of those, tow truck operators.

And we know where his car is, and we'll know when it's on its way home. Because in addition to that, yeah. A lot of these cities have been installed on these cams on traffic lights. Now they know you are going through an intersection and where you went through, what time you went through. Did you wait for that red light? Did you squash it down as the yellow, turned red? It wasn't quite red, yet. This is something else.

Now we're looking at law enforcement dealing with. Violent protesters, right? these fascists who call themselves anti-fascist right. They, these Marxists, they call themselves a the BLM right now. There are legitimate people. There are great people who really care and are really trying to do the right thing. That's not what we're worried about. We're worried about the people that are burning down our businesses, that are causing havoc, that is shooting people that are hitting people over the head with a skateboard or baseball bat.

So the law enforcement in a number of cities now, including New York and Miami. Have been using some facial recognition software to track down and arrest individuals who were participating in criminal activities during these riots. They're doing it after the fact, it's interesting how some of them are doing it.

In some cases like with the fed, they have been tracking them. Watching them while they're in the protests, which is the wrong word is really riots, right? The protest is one thing, burning down buildings, police cars, civilian vehicles, batting people over the head. That's not exactly a protest. What they do is I wait for them to leave the area because you don't want to try and arrest them right in the middle of all of these rioters and they leave the area.

Then they get arrested. Which I think makes a whole lot of sense. Miami pleas are using something called Clearview AI. Now, remember we talked about them a few months ago, maybe six months ago now because this woman allegedly threw a rock at a police officer. Then what they do is they use facial recognition.

Technology not just to surveil them and track them and then arrest them later. They are running it. That's what Clearview does running it through social. Yes, media posts to try and find people. A very interesting problem. Frankly, a New York man air bill DeBlasio promised that the NYPD would be very careful and very limited, and they're not going to arrest it most of these people that are causing bodily harm and destruction of private property. Yeah. Good going mayor DeBlasio. Good. Going a lot of things here. You already know. I don't like Clearview AI, and I don't like the way this technology could be misused by any stretch.

Stick around. We'll be right back listening to Craig Peterson on WGAN and joined me Wednesdays at seven 30 with Matt Gagnon

 Stick around. We'll be right back.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!

Craig discusses the Hawthorne Effect and the changing business office.

For more tech tips, news, and updates visit - CraigPeterson.com

---

Read More:

Patch Tuesday (September 2020): Microsoft Addresses 129 Vulnerabilities

Ransomware accounted for 41% of all cyber insurance claims in H1 2020

A bevy of new features make iOS 14 the most secure mobile OS ever

Don't Fall for It! Defending Against Deepfakes

Patient dies after a ransomware attack reroutes her to a remote hospital

Lock your doors, people: Verizon breach on unsecured AWS server exposes 14M customer records

Time for CEOs to Stop Enabling China's Blatant IP Theft

Newly Patched Amazon Alexa Flaws -- A Red Flag for Home Workers

---

Automated Machine-Generated Transcript:

Craig Peterson: [00:00:00] Hey, is this the great reset or maybe it's the inevitable reincarnation of the corporate office. That's what we're going to talk about right now. What is happening? What's happening at the corporate real estate? How are we using technology to cope?

Craig Peterson: [00:00:18] You're listening to Craig Peterson thanks for joining us.

This is a very interesting problem. We are looking at the corporate offices and we're seeing some major changes. I remember back when I was a professor out at Pepperdine university teaching management information systems 422, MIS 422, right now it's called more of IT, It's more information technology than management information. I remember being a professor there and teaching all of these young minds full of mush. Actually, it was mostly people who already had jobs about the Hawthorne effect. This was absolutely fascinating to me. I think it was Western electric, had a plant out in Illinois and there were just all kinds of workers. They're thinking about it. And I'm looking at a picture of it right now that I pulled up over on Wikipedia and the Hawthorne Works. It's an aerial view drawn by hand, a beautiful pencil work circa 1925. Huge buildings, six stories tall, if you can believe that.

It covered acres and acres, just looking at this picture. Absolutely astounding. There was a study of the Hawthorne studies conducted between 1924 and 1932. In this factory, just outside of Chicago and it was deemed the Hawthorne effect, and here's what they wanted to figure out.

You might've seen something like this in, in some movies in the past here, Schindler's list is one of them, right? How many hinges can you make in a certain amount of time? The Hawthorne Works commissioned a study, do to try and figure out if its workers would become more productive in higher or lower levels of light.

That obviously was just trying to make things a little less expensive for manufacturing. But also because Western electric to justify, you need more light, right? You got to buy lights from us. They found that the worker's productivity seemed to improve where changes were made, but here's what happened. Productivity dropped when the study ended.

What they actually ended up figuring out is that just being observed, changed the way these workers worked. That's the bottom line on this whole thing. There are other basises, if you will, of the Hawthorne, right fact, besides the workplace lighting. It had to do with maintaining these clean workstations, clearing the floors, relocating workstations. They all resulted in increased productivity, but only for short periods. So the Hawthorne effect, that term is used nowadays to identify any type of short-lived increase in productivity.

The big question I have right now is we are working from home more and more of us. We've got major companies out there, including Microsoft, Facebook, and Google. All of those guys, of course, are tech companies, who have closed their physical offices until well into next year. Twitter is told many of its employees. I have don't have an exact number, but Twitter is saying you can work from home permanently to those employees.

Now we have nearly six months. If you can believe it's been six months of forced work from home behind us now. Other organizations are reconsidering the value of office space. Of course, it comes right to mind too, that weSpace guy. If you know who he is, who started this company, where it was shared office space, and the guy turned out to be a real crook, maybe is a good way to put it, but, not a nice guy, not a good guy and he got forced out of that company. But there are others. There's like Regis and others.

But in April of this year, Gallup did a poll and Gallup says that in April 62% of the workforce force was working from home. Now, I think we've got to, as a business, people have to pull back and look at this. Why do we even have these offices in the first place? Is there a real justification for it? I brought up that Hawthorne effect because of the industrial revolution. Instead of having a blacksmith down on the corner and another blacksmith across town and another blacksmith, two towns over. What the industrial revolution did was pull all of the blacksmithing into one factory where we could do it more efficiently. We could do it faster, and we could even come up with a better product because we had better quality control by having it all in one place. I'm postulating and there are some studies that really agree that looked at this, but. We took that model from the industrial revolution that worked great for the physical side of working and we just pushed all of our intellectual workers into that same mold. It's gotta be more efficient, having everyone in one, one workspace where we can monitor and control better. I suspect that this Hawthorne effect we were talking about had something to do with that all, ultimately. That's a very big deal.

Very big deal. So in June this year, Stanford showed that only 42% of the workforce was working from home full time, down about 20%. But that's still almost half of the people. And I really want us all to consider this very seriously. There are some advantages to having people chatting over the water cooler.

So what some businesses have done is they have their employees get together, WebEx teams, and eat lunch together. And they chat about things, right? You don't always have to chat about business. Yeah. It's entrepreneurs, that's all we ever do. That's all we ever think of, right is business, but they're talking about their dog and their kid and just had the had fixed.

And, my bees are doing this week and you have that watercooler chat you still have it, but we have it remotely. Fascinating questions. Management seems to be coming to some conclusions here because, in April, the Gartner Group surveyed and found that 74% of chief financial officers are planning to remove office space, get rid of it.

We know some businesses are selling off buildings. If you're in commercial real estate, of course, I don't give investment advice, but I would be very concerned. The commercial real estate market has been in a bubble for many years, according to a number of people that I follow, who are financial advisors.

So the question really is to what degree should you transform your definition of the office? To what degree should you be transforming your meetings? Your communications channels. Many of us have moved to a team's app or Slack, which is a dangerous thing to use, Slack, but they have found that all of a sudden now people aren't working eight hours a day. They're working 10, 12, 13, 14 hours a day because there's no separation between work and home because people are putting things into these team channels that just don't need to be there.

So there's no question here that there's going to be some sort of a reincarnation of the office. It's bound to change. We're seeing numbers that are proving that right now. It's a very big deal. So I have seen a number of businesses, a lot of them, including big businesses that had projects underway. To redo their offices to build more offices that are now cutting way back. Even one of my kids has just such a job.

She's been working from home ever since March, and will probably permanently work from home. Now as a business person, you also have to consider. Can you compensate these people because it's way cheaper to have them work from home? Maybe you should be chipping in to help with their electric bill. Maybe you should be chipping in to help them get that second screen. Maybe you should not be requiring them to use their own cell phone smartphone to take phone calls on. Okay. So think about all of that stuff.

There will be a multi-year management consulting engagement available for thousands of managers, consultants out there. I've been working at home now for over 20 years. And I owned an office building. I owned a while. I rented office space from other local places that had a business office space. it worked out pretty well for us. But looking back at it, I think almost all of it could have been done and probably would have been done better if they'd been working from home.

If your managers can resist that urge to micromanage where we're installing spyware on people's computers, which I think is going a little too far, then you could get some incredible productivity out of employees. We've seen that happen, as well. Some organizations like consulting, firms, like my business, where we do security, we have people monitoring systems.

We have people designing networks and integrating with existing networks. those types of businesses can function pretty well without any sort of an office, but that means other businesses are going to have to change.

Banks. Want to see that you have a physical office in order to be a business? That's not true anymore. A physical office can be almost anything anywhere. We've got to rethink everything. We have to, as workers are conscientious about this, and as business people, business owners, we've gotta be very careful and very conscientious about this. Of course, earlier in today's show if you missed it, I did talk about working from home and some of the problems we're having right now with security because of the home computers, the home networks, the internet of things, All of that sort of stuff.

If we want to make this post COVID office work best. You've got to make it focus on a place that people want to be, at least occasionally. And that might mean I can tell the place that it's easy to drop in on, and just as easy as it is to work from home. So keep that in mind.

Hey, thanks for joining me today. I am dropping off here on some of the stations, other stations.

We will be back after the break here for another hour, and we're going to be talking about smart lock hacks, Cops in Miami and New York City, and of course, a whole lot more.

So stick around. We'll be right back.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!

Craig discusses the Hawthorne Effect and the changing business office.

For more tech tips, news, and updates visit - CraigPeterson.com

---

Read More:

Patch Tuesday (September 2020): Microsoft Addresses 129 Vulnerabilities

Ransomware accounted for 41% of all cyber insurance claims in H1 2020

A bevy of new features make iOS 14 the most secure mobile OS ever

Don't Fall for It! Defending Against Deepfakes

Patient dies after a ransomware attack reroutes her to a remote hospital

Lock your doors, people: Verizon breach on unsecured AWS server exposes 14M customer records

Time for CEOs to Stop Enabling China's Blatant IP Theft

Newly Patched Amazon Alexa Flaws -- A Red Flag for Home Workers

---

Automated Machine-Generated Transcript:

Craig Peterson: [00:00:00] Hey, is this the great reset or maybe it's the inevitable reincarnation of the corporate office. That's what we're going to talk about right now. What is happening? What's happening at the corporate real estate? How are we using technology to cope?

Craig Peterson: [00:00:18] You're listening to Craig Peterson thanks for joining us.

This is a very interesting problem. We are looking at the corporate offices and we're seeing some major changes. I remember back when I was a professor out at Pepperdine university teaching management information systems 422, MIS 422, right now it's called more of IT, It's more information technology than management information. I remember being a professor there and teaching all of these young minds full of mush. Actually, it was mostly people who already had jobs about the Hawthorne effect. This was absolutely fascinating to me. I think it was Western electric, had a plant out in Illinois and there were just all kinds of workers. They're thinking about it. And I'm looking at a picture of it right now that I pulled up over on Wikipedia and the Hawthorne Works. It's an aerial view drawn by hand, a beautiful pencil work circa 1925. Huge buildings, six stories tall, if you can believe that.

It covered acres and acres, just looking at this picture. Absolutely astounding. There was a study of the Hawthorne studies conducted between 1924 and 1932. In this factory, just outside of Chicago and it was deemed the Hawthorne effect, and here's what they wanted to figure out.

You might've seen something like this in, in some movies in the past here, Schindler's list is one of them, right? How many hinges can you make in a certain amount of time? The Hawthorne Works commissioned a study, do to try and figure out if its workers would become more productive in higher or lower levels of light.

That obviously was just trying to make things a little less expensive for manufacturing. But also because Western electric to justify, you need more light, right? You got to buy lights from us. They found that the worker's productivity seemed to improve where changes were made, but here's what happened. Productivity dropped when the study ended.

What they actually ended up figuring out is that just being observed, changed the way these workers worked. That's the bottom line on this whole thing. There are other basises, if you will, of the Hawthorne, right fact, besides the workplace lighting. It had to do with maintaining these clean workstations, clearing the floors, relocating workstations. They all resulted in increased productivity, but only for short periods. So the Hawthorne effect, that term is used nowadays to identify any type of short-lived increase in productivity.

The big question I have right now is we are working from home more and more of us. We've got major companies out there, including Microsoft, Facebook, and Google. All of those guys, of course, are tech companies, who have closed their physical offices until well into next year. Twitter is told many of its employees. I have don't have an exact number, but Twitter is saying you can work from home permanently to those employees.

Now we have nearly six months. If you can believe it's been six months of forced work from home behind us now. Other organizations are reconsidering the value of office space. Of course, it comes right to mind too, that weSpace guy. If you know who he is, who started this company, where it was shared office space, and the guy turned out to be a real crook, maybe is a good way to put it, but, not a nice guy, not a good guy and he got forced out of that company. But there are others. There's like Regis and others.

But in April of this year, Gallup did a poll and Gallup says that in April 62% of the workforce force was working from home. Now, I think we've got to, as a business, people have to pull back and look at this. Why do we even have these offices in the first place? Is there a real justification for it?  I brought up that Hawthorne effect because of the industrial revolution. Instead of having a blacksmith down on the corner and another blacksmith across town and another blacksmith, two towns over. What the industrial revolution did was pull all of the blacksmithing into one factory where we could do it more efficiently. We could do it faster, and we could even come up with a better product because we had better quality control by having it all in one place. I'm postulating and there are some studies that really agree that looked at this, but. We took that model from the industrial revolution that worked great for the physical side of working and we just pushed all of our intellectual workers into that same mold. It's gotta be more efficient, having everyone in one, one workspace where we can monitor and control better. I suspect that this Hawthorne effect we were talking about had something to do with that all, ultimately. That's a very big deal.

Very big deal. So in June this year, Stanford showed that only 42% of the workforce was working from home full time, down about 20%. But that's still almost half of the people. And I really want us all to consider this very seriously. There are some advantages to having people chatting over the water cooler.

So what some businesses have done is they have their employees get together, WebEx teams, and eat lunch together. And they chat about things, right? You don't always have to chat about business. Yeah. It's entrepreneurs, that's all we ever do. That's all we ever think of, right is business, but they're talking about their dog and their kid and just had the had fixed.

And, my bees are doing this week and you have that watercooler chat you still have it, but we have it remotely. Fascinating questions. Management seems to be coming to some conclusions here because, in April, the Gartner Group surveyed and found that 74% of chief financial officers are planning to remove office space, get rid of it.

We know some businesses are selling off buildings.  If you're in commercial real estate, of course, I don't give investment advice, but I would be very concerned. The commercial real estate market has been in a bubble for many years, according to a number of people that I follow, who are financial advisors.

So the question really is to what degree should you transform your definition of the office? To what degree should you be transforming your meetings? Your communications channels. Many of us have moved to a team's app or Slack, which is a dangerous thing to use, Slack, but they have found that all of a sudden now people aren't working eight hours a day. They're working 10, 12, 13, 14 hours a day because there's no separation between work and home because people are putting things into these team channels that just don't need to be there.

So there's no question here that there's going to be some sort of a reincarnation of the office. It's bound to change. We're seeing numbers that are proving that right now. It's a very big deal. So I have seen a number of businesses, a lot of them, including big businesses that had projects underway. To redo their offices to build more offices that are now cutting way back. Even one of my kids has just such a job.

She's been working from home ever since March, and will probably permanently work from home. Now as a business person, you also have to consider. Can you compensate these people because it's way cheaper to have them work from home? Maybe you should be chipping in to help with their electric bill. Maybe you should be chipping in to help them get that second screen. Maybe you should not be requiring them to use their own cell phone smartphone to take phone calls on. Okay. So think about all of that stuff.

There will be a multi-year management consulting engagement available for thousands of managers, consultants out there. I've been working at home now for over 20 years. And I owned an office building. I owned a while. I rented office space from other local places that had a business office space. it worked out pretty well for us. But looking back at it, I think almost all of it could have been done and probably would have been done better if they'd been working from home.

 If your managers can resist that urge to micromanage where we're installing spyware on people's computers, which I think is going a little too far, then you could get some incredible productivity out of employees. We've seen that happen, as well. Some organizations like consulting, firms, like my business, where we do security, we have people monitoring systems.

We have people designing networks and integrating with existing networks. those types of businesses can function pretty well without any sort of an office, but that means other businesses are going to have to change.

Banks. Want to see that you have a physical office in order to be a business? That's not true anymore. A physical office can be almost anything anywhere. We've got to rethink everything. We have to, as workers are conscientious about this, and as business people, business owners, we've gotta be very careful and very conscientious about this. Of course, earlier in today's show if you missed it, I did talk about working from home and some of the problems we're having right now with security because of the home computers, the home networks, the internet of things, All of that sort of stuff.

If we want to make this post COVID office work best. You've got to make it focus on a place that people want to be, at least occasionally. And that might mean I can tell the place that it's easy to drop in on, and just as easy as it is to work from home. So keep that in mind.

Hey, thanks for joining me today. I am dropping off here on some of the stations, other stations.

We will be back after the break here for another hour, and we're going to be talking about smart lock hacks, Cops in Miami and New York City, and of course, a whole lot more.

So stick around. We'll be right back.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!

Craig discusses how a kid on a zoom virtual learning meeting caused his parents to be questioned by Police.

For more tech tips, news, and updates visit - CraigPeterson.com

---

Read More:

Patch Tuesday (September 2020): Microsoft Addresses 129 Vulnerabilities

Ransomware accounted for 41% of all cyber insurance claims in H1 2020

A bevy of new features make iOS 14 the most secure mobile OS ever

Don't Fall for It! Defending Against Deepfakes

Patient dies after a ransomware attack reroutes her to a remote hospital

Lock your doors, people: Verizon breach on unsecured AWS server exposes 14M customer records

Time for CEOs to Stop Enabling China's Blatant IP Theft

Newly Patched Amazon Alexa Flaws -- A Red Flag for Home Workers

---

Automated Machine-Generated Transcript:

Craig Peterson: [00:00:00] When you think of a violation of somebody violating your privacy, what are you thinking about? Is it people Tom's? Is it somebody sharing a little story about you? That isn't true. with back to school, virtual, um.

Craig Peterson: [00:00:19] Yeah, we've got a story coming out of Joe Biden's country in Maryland. That is very disconcerting. This is from a TV station down in Maryland. Fox Baltimore is the station, and this is very concerning to me. We have many kids that are going to school virtually right now.

If you know me, I homeschooled along with my wife. In fact, primarily my wife, kids, we had eight kids together. They're all grown. This was back before homeschooling was popular. In fact, back when homeschooling was pretty much illegal and I got hauled into court over it, fought and won by the way.

It gets to be a difficult situation now where. You have a kid that's at home, which means your job is now threatened because can you work at home? Even if you can work at home. Okay. You take the time to monitor the kid to maybe help them out a little bit. There are some out there right now, school districts who are saying, you can't monitor, you can't be in the same room as your child. It might violate other children's privacy.

As though children particularly have a right to privacy. in loco parentis thing, the schools are the parents. You are giving up your child to the school and the school can do amazing bad things with your child without your permission. We're not going into that right now.

But I have seen that again and again, in fact, in our court case, it was eyeopening to me what came up, it was just absolutely shocking. Of course, none of my kids were in school and that was part of the problem. But at that point they said, we went to all of the local schools and, we were going over there cause we wanted to speak to your children.

Cause what they do is they just remove the child from the class. If they want to investigate you. The child has no right to have defense there. They don't have to notify you. They don't even have to record it in most cases. Then they sit there with the child and they do who knows what with that child. I've heard stories about, some of these dolls they use, and it's just scary how perverted some of these people are in government and in our school.

In my case, it was well we could not find your kids in school, therefore, they are not being educated, which if you know my kids if you know any of them, the opposite is true. Most of my kids have gone on to get advanced college degrees, university degrees. Yeah. and the rest of them have far more than a university Ph.D. program equivalent.

It's just shocking. Yeah. What they will do in the whole school system and it has to do with the teachers union. There are some fantastic teachers that really care. I remember two, particularly when I was growing up, cause I went to public schools and I remember their names still.

Mrs. Petri, Mr. Cotes, and the impact they had on me. The very positive impact. I had another one too that I have a few memories of. It is a different world today because the teachers don't want you watching over their shoulders. I have read quotes and I've seen a video where some of these teachers are concerned because the parents are going to find out what's going on in the schools.

What they're being taught. We know, for instance, one of the founders and people that are still running black live matter has come out and she's on video proudly proclaiming that she is a trained Marxist. We see that all of the time, they're trying to convince our kids to do that. Now, there are some amazing teachers that not only help the kids to understand it.

I still remember one of my economics professors and how he really was trying to help us understand what was going on. What was the value of different things and why? And I remember his explanation of how the Dow Jones average worked. Oh man, was he wrong? Be that as it may, we have teachers out there and I know them because you guys have reached out to me who are trying to teach the right things in the schools. Who is pushing back on the agenda that some of these teacher's unions are trying to push in this school?

I would suggest that you be very careful when it comes to your kids being online for school. Hopefully, they're not using something like zoom, which is horrific. It is not controllable by the school and the means it needs to be controlled. It is not secure. It is not safe. Don't use Zoom. But, what are you going to say? You're just a parent, right? What are you going to be able to do about it?

Use by all means WebEx teams or a straight-up WebEx. WebEx teams work great for classrooms and it has the types of controls on it so that you can stay private. You can do the things you need to do to really stay private.

So I see the school districts that are using zoom and saying, Whoa, it all for privacy. We've got to make sure that you are not sitting there watching what's going on. In the meantime, they're using Zoom. It's just Whoa, wait a minute. That's obviously not the reason.

Here's a case again, coming out of Joe Biden's home territory here in Baltimore. Where a child was on one of these virtual classrooms and someone reported her because if you can believe this child had a BB gun mounted on the wall, in his bedroom and that was offensive to other children.

And obviously, the parents who were watching over their kid's shoulders. Yeah. It's fine for those nare-do-wells to be watching and complaining. But it's not fine for you to watch your children make sure things are going, okay.

So apparently this parent reported it to the school administrators. The superintendent and the school board demanded answers. She said the principal initially compared bringing a weapon to a virtual class to bringing a gun to school, she was also told that she could not see the screenshot of her son's bedroom because it's not part of a student record.

Yeah. But it certainly got passed around. Didn't it. Okay, so who's on these calls? Who's viewing this stuff? Of course, the police end up coming to her home and the police have a report that they have to investigate a very big deal, Okay. Is this is very scary!

No one called her first. They just called the police and they had the police go by nothing. So the police knock on her door and say, we need to come in by the way. That's what they do. They say, yeah, we have to come in. We need to come in. Even though they may not have a legal basis, two force entry. That's not just true of the police. That's true of most people working for the government, but, she let them in. she let them look around. I have seen this before in my home state. A butcher block on a kitchen counter makes your home an unsafe environment. They tried to remove the children from that home. So that if the kid's in the kitchen and there's a butcher block behind them on a counter, does that mean there's a weapon?

Did that child bring a weapon to the classroom? Cause there's a butcher block in the kitchen behind him. Or there's a BB gun secured on the wall behind him. This is technology in misuse, frankly, if you ask me, okay. This is very bad. This is very sad. This is Joe Biden's. Baltimore, Maryland. Yes, indeed.

So the police searched it. They were in the home for about 20 minutes. They found no violations of the law. Again, that reminds me, of socialism, show me the man, I'll show you the crime. 20 minutes in the home. What might they have found heaven forbid? Maybe an unclean environment with some kitty litter spilled out of the kitty litter box.

I've seen worse. I've seen more done for less. Anyways. Keep that in mind with your kids while they're in these virtual classrooms.

When we come back, we're going to talk a little bit about Uber. You have security charges over there.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553