Eliana Willis

More stories

  • 100 Shares129 Views

    in Information Technology

    Bandwidth CEO confirms outages caused by DDoS attack

    Voice over Internet Protocol (VoIP) services company Bandwidth.com has confirmed that it was suffering from outages after reports emerged on Monday night that the service was dealing from a DDoS attack. Bandwidth CEO David Morken said in a statement that “a number of critical communications service providers have been targeted by a rolling DDoS attack.”

    ZDNet Recommends

    “While we have mitigated much intended harm, we know some of you have been significantly impacted by this event. For that I am truly sorry. You trust us with your mission-critical communications. There is nothing this team takes more seriously,” Morken said.  “We are working around the clock to support your teams and minimize the impact of this attack. Our account managers and support teams have been actively reaching out to customers individually to address any issues. We will not rest until we end this incident, and will continue to do all we can to protect against future ones.” In an earlier statement, the company told ZDNet that Bandwidth “has experienced intermittent impacts” to its services. “All our services are currently functioning normally. Our network operations and engineering teams are continuing to monitor the situation and we are actively working with our customers to address any issues. We will post updates to status.bandwidth.com as we have additional information to share,” the company said. Since that statement was shared, the company has updated the status showing partial outages for a number of inbound and outbound calling services. 

    Bleeping Computer was the first to report on Monday evening that Bandwidth.com was facing issues because of a distributed denial of service attack, which are routinely targeted at VoIP providers.  The news outlet noted that other VoIP vendors like Accent, RingCentral, Twilio, DialPad and Phone.com were experiencing outages and telling customers that the problems were with an “upstream provider.” On its Cloud Service Status page, Accent said on Tuesday that the “upstream provider continues to acknowledge the DDoS attack has returned to their network however we are seeing a very limited impact to inbound calling for our services.”  “Mitigation steps are being put in place to route inbound phone numbers around the upstream carrier the impact to service grows. We will continue to monitor the situation and update the status as appropriate,” Accent wrote.  A source, who asked to have their name withheld, told ZDNet on Monday that their customers were having major problems with their ported phone numbers and that they could not make any changes like forwarding phones.  The company is a downstream reseller of products hosted by Bandwidth and said they knew of a major telecommunications company that “was in emergency mode” due to the situation with Bandwidth.  Just a few weeks ago, Canada-based VoIP provider VoIP.ms said it was still battling a week-long, massive ransom DDoS attack. The REvil ransomware group demanded a $4.5 million ransom to end the attack.  Recent reports have said DDoS attacks are becoming more frequent, more disruptive and increasingly include ransom demands.  Cloudflare said last month that its system managed to stop the largest reported DDoS attack in July, explaining in a blog post that the attack was 17.2 million requests-per-second, three times larger than any previous one they recorded. More

  • 175 Shares199 Views

    in Information Technology

    1Password partners with Fastmail for 'masked email' project allowing users to generate email aliases

    1Password and Fastmail have announced a new service designed to offer users a way to create email aliases and protect their real email addresses. The “Masked Email” service will allow 1Password users to create and manage secure, unique email aliases directly within the 1Password platform. The feature is designed to help users hide their email addresses from certain apps or services they need to use. 

    Fastmail COO Helen Horstmann-Allen said adding the email alias feature to 1Password lets customers protect their email identity in the same way they protect their passwords. “Together, we built a feature I’m really proud of, with a partner who shares our values for both customer privacy and open standards,” Horstmann-Allen said. By allowing users to generate a unique email address, 1Password customers can protect themselves from the kind of phishing emails that have become all too common. A recent report from Deloitte noted that 91% of all cyberattacks start with a phishing email. Andrew Beyer, browser experience lead at 1Password, said people’s email addresses are entry points to their digital lives, making it essential that they remain in control of how they are used and dispersed. “Working with Fastmail, we’ve developed a way to make creating and filling a unique email address through 1Password as easy as generating passwords are today,” Beyer said. 

    Fastmail CEO Bron Gondwana noted that email addresses are effectively a person’s online identity, and if their information is compromised in a data breach, having a randomly generated email address adds a second line of defense “because it can’t be associated with your primary email address, and therefore, your identity.”The companies said the feature is ideal for when someone needs to register for a free Wi-Fi network or sign up for an email newsletter. The email addresses never expire unless you manually remove them, and users can manage their aliases from the Fastmail platform. Users can also pause receiving mail to their email aliases.Troy Hunt, strategic advisor at 1Password and founder of Have I Been Pwned, said it is now known empirically that data breaches happen many times every single day, and the full extent of the problem is larger than anyone can quantify.”My service is now tracking 5 billion email addresses, with each one appearing in an average of 2 data breaches. It’s more important than ever that we protect our privacy, and protecting the primary key to our digital lives — our email address — will have a really positive impact,” Hunt said.  More

  • 113 Shares179 Views

    in Information Technology

    FinSpy surveillance malware is now spreading through UEFI bootkits

    The nefarious FinSpy spyware has now been upgraded for deployment within UEFI bootkits.

    FinSpy, also known as FinFisher/Wingbird, is surveillanceware that has been detected in the wild since 2011. The software’s Windows desktop-based implants were detected in 2011, and mobile implants were discovered a year later. In 2019, Kasperksy researchers found new, upgraded Android and iOS samples, as well as signs of ongoing infections in Myanmar. The Indonesian government was also connected to the spyware’s use.  At Kaspersky’s Security Analyst Summit (SAS) on Tuesday, researchers Igor Kuznetsov and Georgy Kucherin said that detection rates for Windows FinSpy implants have declined steadily over the past three years. However, the software has now been upgraded with new PC infection vectors.  According to Kaspersky, the malware has moved on from deployment purely through Trojanized installers — normally bundled with legitimate applications — including TeamViewer, VLC, and WinRAR. In 2014, its developers added Master Boot Record (MBR) bootkits, which aim to ensure malicious code is loaded at the earliest possible opportunity on an infected machine.  The researchers say that now, Unified Extensible Firmware Interface (UEFI) bootkits have also been added to FinSpy’s arsenal. The malware will, however, check for the presence of a virtual machine (VM), and if found, only shellcode is delivered, likely in an attempt to avoid reverse engineering attempts. 

    UEFI systems are critical to computer systems as they have a hand in loading operating systems. FinSpy is not the only malware to target this machine element, with LoJax and MosaicRegressor also being prime examples. Kucherin did say, however, that the FinSpy bootkit was “not the average we normally see” and all that was necessary to install it was administrator rights. A sample of a UEFI bootkit that loaded FinSpy provided the team with clues to its functionality. The Windows Boot Manager (bootmgfw.efi) was replaced with a malicious variant, and once loaded, two encrypted files were also triggered, a Winlogon Injector and the Trojan’s main loader. FinSpy’s payload is encrypted, and once a user logs on, the loader is injected into winlogon.exe, leading to the decryption and extraction of the Trojan.If a target machine is too old to support UEFI, this does not mean it is safe from infection. Instead, FinSpy will target the system via the MBR. It is possible for the malware to strike 32-bit machines. The spyware is capable of capturing and exfiltrating a wide variety of data from an infected PC, including locally stored media, OS information, browser and virtual private network (VPN) credentials, Microsoft product keys, search history, Wi-Fi passwords, SSL keys, Skype recordings, and more.On mobile, FinSpy will target contact lists, SMS messages, files in memory, email content, and GPS location coordinates. In addition, the malware can monitor Voice over IP (VoIP) communication and is able to rifle through content exchanged via apps including Facebook Messenger, Signal, Skype, WhatsApp, and WeChat.  The macOS version of FinSpy contains only one installer — and the same applies to the Linux version. However, in the latter case, the infection vector used to deliver FinSpy is currently unknown, although it is suspected that physical access may be required.   The latest investigation into FinSpy took eight months. According to Kuznetsov, it is likely the operators “will keep upgrading their infrastructure all of the time” in what will be a “never-ending story.” Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • 188 Shares189 Views

    in Information Technology

    A cloud company asked security researchers to look over its systems. Here's what they found

    While cloud computing services are often touted as more secure than building applications and hosting them in-house, that doesn’t mean those cloud services are without their own flaws. And with hackers increasingly looking to deploy their attacks through the software supply chain, cloud security is back in the spotlight.Cybersecurity researchers found vulnerabilities in the infrastructure of a large software-as-a-service provider which if exploited by an attacker, could’ve been used by cyber criminals as part of a cloud-based supply chain attack. The unspecified SaaS provider invited cybersecurity researchers at Palo Alto Networks to conduct a red team exercise on their development software pipeline in order to identify vulnerabilities in the supply chain.”In just three days, a single Unit 42 researcher discovered critical software development flaws that left the customer vulnerable to an attack similar to those on SolarWinds and Kaseya VSA,” the security company said.At a time when so many businesses are reliant on cloud services, it demonstrates how misconfigurations and vulnerabilities can have a huge impact if not managed properly because of the hundreds or even thousands of companies which are reliant on the infrastructure.SEE: A winning strategy for cybersecurity (ZDNet special report)Initially provided with the limited developer access a contractor would have, the researchers managed to elevate privileges to the extent they were able to gain administrator rights to the wider continuous integration (CI) cloud environment.  

    Using this access, researchers examined all of the environment they could and were able to locate and gain access to 26 Identity and Access Management (IAM) keys. Some of these contained hard-coded credentials which provided unauthorised access to additional areas of the cloud environment, which could be exploited to gain administrator access – allowing what should have been an account with limited access gain privileges which open up the whole environment. While the company which had requested penetration testing was able to detect some of the activity researchers engaged in, it was only after administrator access had been gained that this was the case – in the event of a real attack, this would’ve been too late and attackers would have compromised the system.  After the exercise, the researchers worked with the organization’s security operations center, DevOps, and red and blue teams to develop a plan of action to tighten up security with a focus on the early identification of suspicious or malicious operations within their software development pipelineThe researchers knew what they were looking for so were able to easily identify misconfigurations and vulnerabilities to exploit. While this might involve advanced knowledge of these environments and how to exploit them, it’s the sort of thing that specialised attack operations like ransomware gangs or nation-state backed Advanced Persistent Threat Groups (APTs) would also be familiar with – and will actively exploit if they can, as demonstrated by recent incidents. “Successful supply chain attacks are particularly devastating due to the widespread fallout of the attacks, for example potentially thousands of downstream customer environments being compromised. The risk of fallout conditions should mandate the increase of security mechanisms and procedures used to protect the supply chain”, Nathaniel Quist, principal researcher at Unit 42 at Palo Alto Networks told ZDNet. SEE: Cloud security in 2021: A business guide to essential tools and best practicesPart of the reason these environments can be exploited is because they’re complex and can be difficult to secure – it’s understandably not a simple task and vulnerabilities and misconfigurations can snowball to the extent that with patience and the right skills, attackers could exploit access to service providers and leave customers vulnerable to attacks. There are a number of things which can be done to help protect cloud environments from unauthorised access, including providing access to systems and services on a role-based basis. If developer staff don’t need access to access management keys, then there’s no reason they should be able to gain hold of them. “Role-Based Access Controls (RBAC) within the developer roles would have prevented the Unit 42 researchers from accessing all of the developer repositories. Had the client limited developer user accounts to only the repositories required to perform their job, it would have prevented the red team from identifying all of the 26 hardcoded IAM keys,” said Quist. Organisations should also implement security checks and barriers as part of the development lifecycle. Because if this is implemented properly, it might be possible to determine that there’s been unauthorised access to systems, something which could prevent an attack from being sent down the line to customers.In this scenario, there’s still a security issue to deal with, but dealing with it before hundreds or thousands of customers have been affected is a much better way to deal with it. MORE ON CYBERSECURITY More

  • 125 Shares169 Views

    in Information Technology

    Microsoft warning: This malware creates a 'persistent' backdoor for hackers

    Microsoft has uncovered another piece of malware used by the attackers who were behind the SolarWinds software supply chain attack discovered in December.   Security researchers have discovered numerous modules used by the attack group, which Microsoft calls Nobelium. The US and UK in April officially blamed the attack on the hacking unit of the Russian Foreign Intelligence Service (SVR), which are also known as APT29, Cozy Bear, and The Dukes.  

    Microsoft in March uncovered the GoldMax, GoldFinder, and Sibot components from Nobelium, building on other malware from the group including Sunburst/Solarigate, Teardrop and Sunspot.  SEE: Four months on from a sophisticated cyberattack, Alaska’s health department is still recoveringThe newly discovered malware, called FoggyWeb by Microsoft, is a backdoor used by the attackers after a targeted server has already been compromised. In this case, the group uses several tactics to steal network usernames and passwords to gain admin-level access to Active Directory Federation Services (AD FS) servers, which gives them access to identity and access management infrastructure for controlling user access to apps and resources. This allows the attackers to stay inside a network even after a clean up. FoggyWeb has been used in the wild since as early as April 2021, according to Microsoft.  “Nobelium uses FoggyWeb to remotely exfiltrate the configuration database of compromised AD FS servers, decrypted token-signing certificate, and token-decryption certificate, as well as to download and execute additional components,” explains Ramin Nafisi of the Microsoft Threat Intelligence Center. 

    “FoggyWeb is a passive and highly targeted backdoor capable of remotely exfiltrating sensitive information from a compromised AD FS server. It can also receive additional malicious components from a command-and-control (C2) server and execute them on the compromised server,” Nafisi adds. The backdoor allows abuse of the Security Assertion Markup Language (SAML) token, which is used to help users authenticate to applications more easily.SEE: Don’t want to get hacked? Then avoid these three ‘exceptionally dangerous’ cybersecurity mistakesMicrosoft recommends potentially affected customers take three key steps: auditing on-premise and cloud infrastructure for configurations, and per-user and per-app settings; removing user and app access, review configurations, and re-issue new, strong credentials; and using a hardware security module to prevent FoggyWeb from stealing secrets from AD FS servers. Microsoft in May uncovered more Noeblium infection tools, including EnvyScout, BoomBox, NativeZone, and VaporRage, as well as a spear-phishing campaign that piggy-backed on a legitimate US email-marketing service. More

  • 100 Shares129 Views

    in Information Technology

    Scalper bots are now targeting graphics card vendors

    When you think of automatic bots, it may be that the first thing that springs to mind is the annoyance of getting up early and waiting in anticipation for concert tickets to go on sale for your favorite band — only to have them all slurped up within seconds. 

    It’s a well-known practice. Set up a bot to purchase a coveted item or service and then sell them on the market with a steep mark-up. Generate profit, move on to the next in-demand product.  Reselling online is big business, and when individuals lost their jobs due to the COVID-19 pandemic, some turned to bot operations to make ends meet.   Others simply work this business to make a profit on hot ticket items. One group, for example, claimed to have secured 3,500 PlayStation 5 consoles in the Europe and UK, contributing to an almost immediate sell-out of the next-generation gaming system.  An issue surrounding the supply of PS5s is a global shortage of chips, made worse by the pandemic and natural disasters. Graphics cards, for example, are in high demand not only by tech vendors but also gamers and cryptocurrency miners — and in response to this demand, scalper bots have made their presence known.   On Tuesday, bot mitigation platform Netacea published its Top Five Scalper Bots Quarterly Index, a tracking report that identifies the hottest products most often targeted by scalper bots.  Covering April to June this year, the company says that the most popular item were the $110 Air Jordan Retro 1 High OG sneakers, which once scalped and resold, have gone for up to seven times — or more — their original price tag. 

    The second most coveted item was the PS5. One bot observed by Netacea made “one million purchase attempts” in only six hours. In third place were graphics cards suitable for gaming purposes. The most popular product scalpers tried to secure was the NVIDIA RTX 3000 series. In fourth was another fashion item, Yeezy Boost 700 MNVN sneakers, and in fifth, chips made a comeback — graphics cards marketed for cryptocurrency mining purposes.”It’s an especially difficult time for retailers,” commented Andy Still, chief technology officer at Netacea. “In addition to supply chain issues adding to the challenges of the last two years, they increasingly face the risk of bots buying their most popular items before their customers — a trend that negatively impacts prices and a brand’s reputation.”  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • 188 Shares129 Views

    in Networking

    FCC details $1.9 billion program to rip out Huawei and ZTE gear in the US

    The US Federal Communications Commission (FCC) has laid out the rules for small carriers that are applying to access a pot of $1.9 billion to rip out and replace network equipment and services from Huawei and ZTE. The rules state that carriers will need to have under 10 million customers and allow for the possibility of some schools, libraries, and health care providers gaining access to funds if they provide broadband services. For the purposes of the program, equipment would need to be capable of speeds above 200kbps in either direction. “The reimbursement program will reimburse eligible providers of advanced communications services for costs reasonably incurred for the removal, replacement, and disposal of their Huawei and ZTE equipment and services obtained on or before June 30, 2020,” the FCC said. “RRD costs incurred prior to April 17, 2018 will not be reimbursable.” The FCC said in the cases of older network, replacing like-for-like may not be possible, and instances such as ripping out an older mobile network to be replaced by LTE or 5G-ready equipment would be allowed. Those receiving the funds will not be able to replace microwave backhaul or fixed wireless links with fibre links. If a tower is not capable of holding replacement equipment, the cost of a new tower would be considered on a case-by-case basis, the regulator said. Applicants for the funds will be able to claim vendor travel expenses and salary costs of internal employees dedicated purely to the replacement program.

    “Separately, the commission has determined that the replacement of non-Huawei or ZTE mobile handsets and other customer premises equipment, including Internet of Things devices, used by end users to access and utilise advanced communications services are not reasonably necessary to the removal, replacement, and disposal of covered communications equipment or service,” it said. The window for applying runs from October 29 to January 14, with successful applicants expected to be informed in early Q2 2022. The program has been in the works for two years, with the FCC officially designating Huawei and ZTE as national security threats in July 2020. Separately, over the weekend, the US Justice Department and Huawei CFO Meng Wanzhou cut a deal to end an extradition lawsuit that ran for nearly three years. Meng admitted only to misleading global financial institutions, and did not plead guilty to the various fraud charges imposed against her. Without even trying to hide its hostage diplomacy tactics, Beijing subsequently released two Canadians who were detained shortly after Meng’s arrest and kept in Chinese prisons.By contrast, Meng was able to live under house arrest in one of her two Vancouver homes. Related Coverage More

  • 100 Shares159 Views

    in Networking

    The best 5G home internet: Your broadband options

    It used to be that we could do okay with less than 10 Megabits per second (Mbps) internet.  That was before we filled our evenings with streaming movies and TV shows and our days with working from home on Zoom meetings and Software-as-a-Service applications. Now, we need at least 25 Mbps, the more the better.Fiber internet offers the best speeds for those lucky enough to have it, and cable is the second-best option. After that, it’s a real drop-off. For example, DSL tops out, in theory, at 100 Mbps, but in practice it maxes out at 25 Mbps. It’s also on its way out, with big providers like AT&T no longer offering it. There are other alternatives such as Wireless ISPs (WISP), 4G-based internet, the old and slow satellite internet services, and the fast (but difficult to get installed) low-earth orbit (LEO) Starlink. Now there’s a new wireless internet alternative to add to the mix: 5G internet. 5G home internet uses the same signals as 5G phones, but it is a fixed wireless internet service. WISPs have been around for decades — I installed one in the 80s from an off-campus site to Goddard Space Flight Center — but these services tend to be point-to-point. That means they use a line of sight between their antennas and yours for the connection. 5G internet doesn’t need a line of sight connection. It does require an indoor or outdoor 5G receiver at your home to pick up the signal. Once there, you’ll also need a router to get the signal to your PCs and smart devices. You also should know that just because you’re using your smartphone’s 5G network, you can’t move it. Your gateway is locked to your location and cannot be used elsewhere.5G internet is very much a work in progress. For example, AT&T offers a 5G mobile service and fixed wireless internet, but the two aren’t connected. For now, their wireless internet service doesn’t use its 5G network.One company, FreedomFi, is working on a do-it-yourself 5G network. You can expect to see smaller companies offering local 5G internet services using their open-source technology within the next 12-months. In the meantime, there are three major 5G internet providers: Starry Internet, T-Mobile Home Internet, and Verizon 5G Internet.

    Wireless ISP meets 5G

    CNET

    Spec Category: 5G Internet| Spec Category: Internet |  Price: $30 |Starry Internet lives between old-school WISP and 5G. It uses the high-frequency bands in the 24 and 37GHz range to deliver your Internet. Within that range, it uses 5G millimeter wave (mmWave) technology. But, unlike Verizon, which uses mmWave for its Ultra Wideband short-range 5GT-Mobile Home Internet phone service, thanks to its point-to-point approach Starry has considerably more range. That’s the good news. The bad news is that Starry is still unavailable in most locations. By 2022, the company plans to expand from Denver, LA, and cities in the NorthEast corridor to tens of millions of users.Starry developed and manufactured every part of its offering. Everything from the antennas, the base stations, the receivers, and even the Wi-Fi router is all the company’s own design and work. It’s all built to work well together for the best possible performance. Starry users tell me that the service delivers the promised speeds.Like satellite services, users I know who have Starry report that rainy or snowy weather can sometimes slow down or even knock the connection. On the other hand, they also report that Starry has excellent customer service. And, when was the last time you heard anyone say that about an ISP?All of Starry’s plans come with unlimited data, no equipment fees, and no contracts. These plans start with Starry Basic, which comes with 50Mbps up and down services for $30 a month. Starry Plus, which is widely available, provides 200Mbps down and 100Mbps up, costs $50 a month. There are other, faster and more expensive packages. These top out at a Gigabit per second (Gbps) down and 500Mbps up for $80 a month. But, these service offerings are not widely available. Starry also offers an affordable internet plan for seniors, students, and low-income households. This option, Starry Connect, costs $15 per month, for symmetrical upload and download speeds of 30Mbps. Starry Internet is currently available in Boston; Columbus, Ohio; Denver; Los Angeles; New York City, and Washington, DC. Its 2022 expansion roadmap includes approximately 30 million households in such cities as Atlanta, Chicago, Dallas, Detroit, Houston, Indianapolis, Memphis, Miami, Philadelphia, Phoenix, Portland, San Francisco, and Seattle.If you can get it, Starry is well worth checking out.   Pros:   Excellent price.   No data cap   Good customer supportCons:   Very limited availability

    Easily the most widely available 5G Internet service

    CNET

    Spec Category: 5G Internet| Spec Category: Internet |  Price: $60 |T-Mobile says you’ll automatically receive the best speeds is by far the most widely available 5G internet service. There’s really no comparison. That’s because T-Mobile both bought Sprint and thus got its 5G bandwidth allotments and it’s worked hard on its mid-range 5G deployment.  For you, that means even if you live way out in the country, odds are good you’ll get reasonably fast internet.True, T-Mobile’s not the fastest 5G service around. That’s because depending on where you live and how much bandwidth all the other T-Mobile customers are using, your service will switch between 4G LTE and 5G. Today, T-Mobile expects you’ll get up to 100Mbps download speeds. CNET recently tested T-Mobile’s service and reached a high of 132Mbps. The company warns that the “vast majority of our customers experience speeds of 25Mbps or more.” The company doesn’t offer tiered speeds or pricing today. T-Mobile says you’ll automatically receive the best speeds available at your address. As better speeds are available, you’ll automatically get them for no additional cost.On the other hand, T-Mobile has no data caps whatsoever. You can use all the internet you want without worrying about running out of bandwidth. T-Mobile Home Internet is just $60 all in with AutoPay for customers who already have (or switch to) a tax-included plan. This also includes all setup fees and taxes and has no annual contract. You can currently, available through the end of 2021, get $10 off Google’s YouTube TV if you’re a new subscriber.For rural users, T-Mobile is a no-brainer. It’s far better than most countryside ISP choices. Pros:   Good price.   No data cap   Wide availabilityCons:   Limited speed

    Verizon’s internet speeds claims exaggerated

    Verizon

    Spec Category: 5G Internet| Spec Category: Internet |  Price: $70 |Let’s get straight to the point. Verizon 5G Internet claims you can get from 300Mbps to 1Gbps with its service. I know of no one — No One — who gets anything close to that speed. They make that claim because if you’re within a few dozen yards of one of their 5G Ultra Wideband towers you may see those speeds. If you look at Verizon’s fine print you’ll find “5G Ultra Wideband is available only in parts of select cities.” But, when you’re living somewhere like that chances are you can already get high-speed cable or fiber.For the rest of us, you’re stuck with 5G Nationwide, which uses Dynamic Spectrum Sharing (DSS). This is only 5G for advertising purposes. It actually uses the 4G LTE spectrum and has almost identical speeds. These speeds typically come in around 25 Mbps. But, Verizon is also using its recently acquired Citizens Broadband Radio Service   (CBRS) to speed up its 4G LTE and Nationwide offerings. Early CBRS deployments are hitting speeds of 700Mbps. Verizon also recently bought the right to use the C-band spectrum. This will also increase its 5G Nationwide range and speed. Verizon 5G Home Internet pricing is $70 a month, or $50 a month for Verizon mobile customers who already pay at least $30 a month. For this, you also get your equipment, setup fees, and taxes.  It also doesn’t have a data cap.  Verizon’s 5G Home Internet is currently offered in parts of 57 different markets, including Akron, Ohio; Albuquerque, New Mexico; Arlington, Texas; Anaheim, California; Ann Arbor, Michigan; Atlanta; Austin, Texas; Charlotte, North Carolina; Chicago; Cincinnati; Cleveland; Columbia, South Carolina; Columbus, Ohio; Dallas; Denver; Des Moines, Iowa; Detroit; Durham, North Carolina; Fremont, California; Fresno, California; Greensboro, North Carolina; Gresham, Oregon; Hartford, Connecticut; Houston; Indianapolis; Kansas City, Missouri; Las Vegas; Little Rock, Arkansas; Los Angeles; Louisville, Kentucky; Memphis, Tennessee; Miami; Milwaukee, Wisconsin; Minneapolis and St. Paul, Minnesota; Nashville; New Orleans; Niagara Falls, New York; Omaha, Nebraska; Orlando; Pensacola, Florida; Phoenix; Raleigh, North Carolina; Riverside, California; Sacramento, California; Salt Lake City; San Antonio, Texas; San Diego; San Francisco; San Jose, California; Sarasota, Florida; Seattle; Spokane, Washington; St. Louis; St. Petersburg, Florida; Tampa, Florida; and Tucson, Arizona. That’s a long list, but note they say “parts” of markets. You can literally get a signal in one block and bupkis in the next one.Now you may be lucky enough to live next door to a Verizon  5G Internet tower. In that case, you’ll see great speed and little latency. But, for most of us, Verizon’s not impressive. That said, by this time next year it may be a different story. Verizon’s new technologies should boost its average speed and range considerably. Check in next fall and Verizon may be the best 5G internet option around. Pros:   Good price.   No data capCons:   High speed has very limited availability

    Three kinds of 5G

    You may think 5G is one technology. It’s not. 5G is an umbrella term for three different kinds of 5G. These are mmWave, midband, and low-band 5G. These are all very different from each other. What Verizon wants to sell you, mmWave, under the tag line, “This is 5G built right,” is only “built” today in a handful of places. It currently runs on 24 and 28 GHz bands and won’t be spreading anytime soon. That’s because its range isn’t much more than Wi-Fi’s range. Sure, you can cover a stadium with it, but city blocks? Dream on.Besides mmWave’s limited range, it has no penetration to speak of. Your office’s walls will block it. Heck, even leaves and windows can seriously slow it down. So, sure outside while you’re cheering on your team you may see Gigabit speeds — so long as not too many of your fellow fans are using up the bandwidth — but in your business or home? Forget about it. The only way you’ll see 5G inside most buildings is the same way you get Wi-Fi in them: By filling them with access points.Midband, which can run between 1 GHz and 6 GHz has more coverage and penetration than mmWave. Sprint, now owned by T-Mobile, was the first to roll it out at 2.5 GHz. Midband averages real-world speeds of over 100Mbps downloads. By comparison, 4G LTE averages just over 20 Mbps. Its range varies depending on exactly which frequency it uses, but it will be considerably more than mmWave and about half that of 4G LTE.Low-band 5G, which T-Mobile launched on Dec. 6, 2019, lives in the 600 MHz spectrum. If you’re an old-school TV watcher of a certain age, that’s where your UHF TV channels 38-51 live. This kind of 5G has a far greater range than the others or 4G LTE. A single tower can cover hundreds of square miles. Its performance will vary, but it’s usually at least as fast as 4G LTE’s 20+ Mbps and can reach speeds of up to 250 Mbps.That sounds great, and if you live in rural America, low-band 5G is going to be a game-changer. If you live in a city it may be a different story. Depending on how the spectrum is divided up between the mobile carriers, there may not be enough spectrum for T-Mobile’s 5G to show to its best advantage.Verizon also advertises what it calls 5G Dynamic Spectrum Sharing (DSS). This is not really 5G. It’s just marketing. Verizon admits that all you really get from 5G DSS is about the same range and performance as you’re already getting from Verizon 4G LTE connection.Finally, your Wi-Fi router’s 5GHz is not the same thing as 5G. Wi-Fi uses short-range radio frequencies, 2.4 or 5Ghz to transmit your internet signal from your ISP to your home or office devices. While techies can use Wi-Fi to link networks over long distances, your router’s 5Ghz is in no way a last-mile internet connection. 

    What internet speed is right for you?

    Your ISP will tell you one thing on their websites but remember they want to sell you more bandwidth. ISPs can also mislead you about what they can actually deliver. Over the years, I’ve been told by ISPs they could hook me up with connections they literally couldn’t deliver. And let’s not even talk about their speed guarantees, which more often than not are wishful thinking. To see what you really get from any given connection, run one of these internet speed tests.The following is a useful list to see how much bandwidth you need from your internet. Keep in mind, though, that these are additive. For example, if you’re video-conferencing in HD (20 Mbps), while your partner’s watching Dune in 4K on HBO Max (35Mbps), and your kids are playing Fortnite (35 Mbps), you’ll need 90 Mbps to keep everyone happy. But, wait, there’s more. For example, even if you only have one or two people in your home, there are more than 10 internet-connected devices in the average US home. Besides the ones you first think of — computers, streaming devices, and gaming consoles — there are also smartwatches, Internet of Things gadgets, and even pet-tracking devices. If you’re using these devices all the time, then you’ll want to have enough bandwidth to power all of them.For example, in my computer-happy home office, I have over 30 internet-connected devices. If you’re a faithful ZDNet reader, chances are you too have a house filled with net-connected devices. So, to account for all those internet-connected devices, I’d add another 10 Mbps to your account. In my hypothetical family that brings your total required bandwidth to 100 Mbps. 

    How much are 5G upload speeds?

    Not so long ago, most homeowners didn’t care that much about upload speeds. Then, we all started working from home. Now it’s a different story.  We need good upload speeds for our video-conferencing and work. Except on fiber internet connections, most internet technologies offer far lower upstream speeds than down. For example, my cable Gigabit plan gives me in real life no more than 800Mbps down, but only 40Mbps up. Yes, that still sounds fast, but if you’re doing a lot of online classes or video-conferencing you can run right into those limits and end up with a bad connection. Generally speaking, 5G services ratios are better. Technically, 5G services provide half the upstream speeds they offer downstream. So, a 600 Mbps hookup should give you 300 Mbps uploads. As always, check the fine print, if upload speeds are a critical concern for you. 

    Will you get advertised speeds?

    Speaking of fine print, what ISPs promise they’ll deliver in the way of bandwidth often isn’t what you get. For example, the Federal Trade Commission, along with law enforcement agencies from six states, recently sued Frontier Communications, alleging that the company didn’t provide many consumers with the internet speeds it promised them. And, adding insult to injury, the company charged many of them for more expensive and higher-speed service than was actually provided.  In my experience, this is all too common. According to AllConnect, a company that promises to help you find the best telecommunication deals, “15% of internet users, or 45 million people, are getting less than their advertised speeds.” Of those, “Fiber and cable internet have the biggest gap – with most people getting, on average, about 55% of the speeds they pay for.” In the case of 5G what speeds you actually get also depends on how far you are away from the tower. And, if your ISP has oversold your local connection, your speeds will also be slower when everyone tries to use it at once. The short tell for this is if during prime TV watching time your connection starts to slow down. All those streaming shows eat up a lot of the available bandwidth.  

    Internet connection factors besides speed to worry about

    Sure, if all you do is e-mail then you can get by with 6 Mbps or less. But, if you’re routinely transferring large files, having video conferences, or streaming 4K video, you need all the speed you can get. But, there’s more to the matter than just raw speed.If you need fast throughput, you also need the highest data cap you can get. It doesn’t matter how quick your connection is if your service drops your speed to a crawl. For example, the satellite ISP HughesNet’s speed maxes out at 25 Mbp, that’s not great, but you might be able to live with it. However, once you’ve gone over 10 GB–50 GB of data depending on your plan, speed is cut drastically. Or, other plans let you keep your speed, but they start charging you extra. For instance,  AT&T’s fixed-wireless internet plan—which is available to rural internet customers in remote areas has a 350 GB data cap. When you go over it, it costs $10 for every additional 50 GB. Because data caps vary, be certain to check the fine print. ISPs make a point of not sharing this information so double-check if you think you’re using so much data that you might break your provider’s data cap. 

    How to choose  

    Which 5G internet provider is right for you?Start by using the provider’s online form to see if service is available at your address. It’s also wise to ask neighbors who already have a connection how well it works for them. ISPs have been known to promise more than they can deliver and you don’t want to be trapped in a bad deal. You should also look at any available add-ons. Besides voice phone service, some provide discounted rates for streaming services. AT&T, for example, bundles HBO Max with some high-end internet packages. ISPs also commonly offer e-mail services and some offer virtual private networks (VPN) services.

    ZDNet Recommends More