Phishing on the iPhone

The bad people are at it again.

This time, it is "phishing" <https://en.wikipedia.org/wiki/Phishing> on the iPhone--attempts to get you to give them your Apple account credentials. For clarity: This is not malware residing on your device; it is a message that came in piggyback with something else.

Occasionally, iPhone (or any iOS device) will need your credentials (ID and password), and will make its request by putting up a "slip" containing the notification. You may be able to dismiss without complying, but the request would return the next time the OS needed access to Apple services. We become accustomed to just doing what is needed without thinking about context--and this is what the jerks are counting on. They display such a request (looking more or less identical to the legitimate one), and we pass them our credentials (username and password).

The article below suggests that such request be dismissed immediately, but then one should go to System Settings to see if the request is there--and if so only there to supply the password being requested.

This would be similar to our _not_ using the convenient link in e-mail from [someone posing as] a bank; instead we use the links previously stored in our Contacts address books.

<https://krausefx.com/blog/ios-privacy-stealpassword-easily-get-the-users-apple-id-password-just-by-asking>

I hope this helps.

Mark_ 

15 October 2017 21:46 

E-mail warning (real fake)

I have just received this "helpful" e-mail:


| From: GoogleReminder
| Subject: Message you sent blocked by our bulk email filter Socrates
|
| Lauren Collins (Gmail Support) sent you a message:
|
| 3/17/2017
| Message status: undeliverable
|
| <Learn more>
|
| <View Messages>
|
|
| Don't want occasional updates about Gmail activity? <Change> what email Gmail Service sends you.


The return address nor any of the links is real; they all lead to places that aren't anything Google.  (This is easily checked; ask me, if needed.)  (They had not used my Gmail eddress, either.)  


My microwave/camera was of no help at all.


Mark_
17 March 2017 @ 14:30

How to reply to an e-mail message: a kindness

When replying to an e-mail message, it is a common practice to insert your comments after the quoted material to which a comment pertains.  It might look something like this (depending upon the mail client being used)

| This would be a received comment, as quoted into
| a _reply_.  It might be only a few lines long, or it
| could contain multiple paragraphs.  Some mailers
| use a "> " at the left margin.  The recipient of
| your mail does not know which your mailer is
| showing to you.

And _this_ material would be a replied comment,
inserted after the material to which it pertains; it
will not be "marked" in any way.

However:

Inserting comments is not always appropriate, and on small screens it might seem somewhat inconvenient.  In the event that quoting material back to the originator is not needed for clarity, it is a kindness to remove it before hitting <send>--especially if pictures are involved.  Image files are quite large, and when they are replied back to the sender, they then reside on his hard drive twice.

Recipients whose hard drives are nearly full will thank you.


Update 24 March--one more thing:  Many/most/all of our mobiles (celephones, etc.) append "Sent from my iPhone" or etc. to outgoing mails.  You never see it, but we do.

It can be disabled more or less immediately after your acquisition of the device; see its Preferences for the setting that can turn it off.

Thanks.


Mark_
25 January 2017
Day 6 of the new Dark Ages: _"Idiocracy" Live_.

Reminder: "Spear Phishing" (Warning)

I post this as a timely reminder that an e-mailed convenience can be used to compromise your online accounts.  The technique is referred to as "spear phishing"; it works like this:

You receive an e-mail message informing you of the need to go change your password, and a convenient link to the necessary settings page is provided right on the message.  This link goes not to where you are being told it does, but to a lookalike page that delivers your information to the criminals.

The safe solution is simple: Take the alert seriously--don't even bother considering the other alternative.  However, use the links you should have entered into your own address book software for that institution or web service.  In this way, you use your IQ to divert _bad luck_ away from yourself (and, alas, toward other people).

I wrote "timely" because this is apparently the technique that got [someone] into Democratic e-mails during the period before the 2016 presidential election.  

• New York Times <http://www.nytimes.com/interactive/2017/01/06/us/russian-hack-evidence.html> 

• Wikipedia <https://en.wikipedia.org/wiki/Phishing> 

I have said this before:  Most of us have lived our entire lives in neighborhoods (both our domiciles and our retail and other business activities) in places where criminal activity was more a matter of news reportage than of experience.  Now the criminality--the actual threats--come(s) right into our homes.

Welcome to the constantly-connected future.

Mark_

06 January 2017 (a date that still seems like it belongs to The Future)

Extremely ugly Windows malware

A new piece of Windows malware has been in the news.  This one is pretty scary.

CryptoLocker arrives as a Trojan Horse--an executable disguised as something else, such as a PDF or picture file--that when opened silently encrypts your files using "military-grade" encryption that has been characterized as "infeasible" to decrypt without the key. Your stuff is still there, but unreadable. Permanently.

On completion of the encryption process, you will be presented with a _demands_ screen: Within some fairly limited amount of time, pay hundreds of dollars using any of several methods, or the key will be "destroyed". (Turns out that this "destruction" may not be without appeal, but the second chance is worth _thousands_ of dollars.) Pay up (an act as galling as it is expensive in a couple of ways), and the key will be returned and files decrypted. (Some report success, others report otherwise, apparently. The perpetrators are criminals, after all.)

For information, Google "cryptolocker", and read the Wikipedia article first.

A Windows user should do (at least these) three things:
1. Set your anti-virus on _kill_. (Make certain that it is engaged and that it is using the latest definitions.)
2. Back up to an external drive. Check the backup to see that its files are readable.
2. Be extremely vigilant about opening files that have been e-mailed to you. Open _nothing_ about which you can have the slightest doubt as to provenance. It is at this point that the infection occurs, and it does so silently. One is aware that one has troubles only when the damage has already been done.

Power users have other tools, but they are arcane and _unlikely_.

Note that this exploit runs on "social engineering"; getting the victim to participate by scamming him. The user is the line of defense; knowing what to expect and how to recognize the threat before it is put into play are key to staying safe.

There is one more way of staying out of harm's way, but I won't mention it because it can make a Macintosh user seem far too pleased with himself--and besides, his own safety may not be permanent.


Mark_

Making telephone calls without a telephone

I have just had an experiment with telephoning from Apple's iPad; any microphone-equipped iOS device can do it (even if by use of a headset such as Apple's earbuds with in-line mic).  (Actually, the oldest of the iPod touches may not run a sufficiently recent OS for the required software.)  Instead of using the cellular voice network, it uses wi-fi or 3G to connect to the world; therefore it does not "use minutes".

For quite some time, Apple banned software that could imitate or replicate iPhone functions, but through whatever change or policy alteration there is now a way of making non-phones seem very much like telephones.

Required:

• iOS device, microphone equipped: The first iteration of iPod touch lacked a real speaker, and the first two generations lacked microphones.  I am not certain offhand about the original, but in the second generation both deficiencies can be made up by use of a set of earbuds with in-line microphone.
• Wi-Fi: Network access to the outside world.
• Google Voice telephone number: A popular and free-of-charge way of connecting with real telephones <http://www.google.com/googlevoice/about.html>. Originally, a way to use a computer as a telephone and to add "features" to one's existing telephone service(s). Will take voice-mail and notify you of a missed call. (With a transcript--although those can frequently seem /odd/.)
• Talkatone: iOS software "telephone" <http://www.talkatone.com>.  (UPDATE: there may be other apps that can serve here.  MagicJack <http://www.magicjack.com> and Skype <http://www.skype.com/en/offers/skype-number/> can also imitate telephones.  There may be others.)

After installation and configuration, the combination of hardware, network access, account, and software permits the iPod touch and iPad to work as telephones, both originating and receiving calls from real telephones out in the world.  Not a bad thing to have on a real iPhone, too; permits having free calls via wi-fi with telephones that don't have your cellular provider's _no-minutes_ privileges.  (In which case--at home--don't have it receive calls over wi-fi; the interface gets confused when both the iPhone and Talkatone receive the same call simultaneously; yes, this can happen.  When you explore Google Voice features, this will make sense.)

So: When a household has only one celephone, the _other_ spouse can still have a telephone number with access to the device's iOS addressbook--which is much superior to what most cordless (or other?) household telephones have.  That "virtual telephone" would work while it had access to wi-fi at home, at a friend's, at the library, or at a coffee shop.  Hardly as ubiquitous as real cellular, but perhaps good enough to seem attractive to people who already have iPods touch or iPads, and who would be interested in extending their functionality in that way--with no charge whatever.

If that sounds intriguing--and if I have explained it badly here--get in touch.  It does seem to work pretty well (so long as nobody is running the microwave, of course).

Mark_
06 July 2013

Linkedin Spam

A day or so ago I began receiving contacts from people on the social-networking service Linkedin (to which I do not subscribe). The first few wanted to use my picture, or somethingsomething, but today's got my attention to a higher degree: "Please stop spamming me with links to your business!"  Because this suggests that one's e-mail address has been hijacked (if not one's actual computer), I looked around for information. (Google: "linkedin spam".) Some of what Google found goes back to 2010 (or beyond).

I found several references to (this) new activity, including this from PCWorld: "Warning: Fake LinkedIn Spam Can Steal Your Bank Passwords". The spam came to my Apple eddress, which others have noticed: Is anyone else receiving LinkedIn spam...: Apple Support Communities. We hope Apple's mail servers or the MobileMe system have not been hacked. (Fairly scary thought.)

Oh--note also that some anti-malware software failed to protect Windows machines from this infection.

What isn't clear yet is whether the malware it installs can run on Macintosh; in the past, the bulk of this kind of thing was OS-specific (and therefore targeted only Windows). There are a couple of classes of code that can run on (virtually) any OS, though, so we'll be very careful not to click any links on such e-mails--not even on the unsubscribe (or in this case the "adjust...settings") links, which can lead to places you wouldn't want your browser to go.

In fact, it is a general rule that one should never unsubscribe using the link provided on an unwanted e-mail. Even if it seems to have come from a trusted source, a safer practice would be to use the unsubscribe link found on the source's own web site.

So, there is today's learned the hard way by someone else lesson. We shall consider ourselves lucky.

Mark_

11:57 16 January 2012

Printing from iOS Devices

I recently helped a friend with setting up a Macintosh laptop for printing to a wireless printer.  The point of that included permitting the household's iPad to print, something I had believed to be possible in principle but had not investigated as yet.  Turns out that printing from iPhones and such--wirelessly!--is possible; in some cases however, use of non-Apple software is necessary.  This little "paper" will focus on the non-Apple side of the question.

Apple has a new wireless printing standard called "AirPrint".

• <http://www.apple.com/ipad/features/airprint.html> 

• <http://www.ipadforums.net/airprint/28756-printing.html>

Unfortunately, AirPrint works only with a fairly small number of AirPrint-ready wireless printers; the printer in question was wireless but non-AirPrint-ready.

Canon, Epson, Hewlett Packard, and Lexmark all offer free iOS apps for printing wirelessly--even to printers that are not themselves wireless devices as such.  (There are quite a few pay apps, too, offering combinations of printing, scanning, and "cloud" storage.  I have ignored those.)

This is about a particular non-Apple application that I have installed and tested on my old iPod touch, printing to a 3-year-old Hewlett Packard all-in-one.

• HP, for example: <http://h30434.www3.hp.com/t5/Other-printing-questions/HP-DESKJET-3050-all-in-one-j610a/td-p/843985>

Note the confusion on that page; an app is required: 

<http://itunes.apple.com/us/app/hp-eprint-home-biz/id299531647?mt=8>.  

So: Install (and register) the appropriate app, "Share" your printer to the network (in System Preferences), (there may be other steps,) and your iTouch (iPhone, iPad, iPod touch) can see and print to it when on your home network (and your computer is awake).  (It's possible to print to your home printer when away, too, but that requires some fairly complicated setup--and that the computer remain awake while you are away from the house.)

Instead of adding a global Print command; instead, the HP app can print some kinds of material for which it has built-in viewers.  I have tested it using my second-generation iPod touch, and it printed to my non-AirPrint, non-wireless printer; I was gratified to receive only a moment later the printout of one of the pictures stored on my device.

Presumably, wireless printers would not need for the computer to be awake.

For most purposes, either syncing or e-mailing content from the hand-held to the big computer is superior for any number of reasons (and will be required for some kinds of content).  However, when a hard copy of a few common types of things is desired immediately, this is _the cat's pajamas_: Launch app--Select content--Send print job to printer while walking toward computer room--Retrieve printout from tray--enjoy.

By the way--we did establish wireless printing from the MacBook to the HP wireless printer.

All excellent! 

Mark_

10:39 22 September 2011

TV as Computer Monitor

Someone asked me recently about using a TV as a computer monitor.

We have been enjoying our gen-2 Apple TV (which streams from a number of Internet sources via Wi-Fi), but before that we connected our MacBook to the television. The aspect ratios of Macintosh and the TV were slightly different, but all-in-all it worked well enough.

Lifehacker article: Computer to TV.

Mark_
14:22 13 June 2011