Information Technology

Police have dismantled an organised crime group linked to the Italian mafia which defrauded hundreds of victims through phishing attacks and other types of online fraud.The joint operation was led by the Spanish National Police (Policía Nacional), with support from the Italian National Police (Polizia di Stato), Europol and Eurojust and has resulted in 106 arrests across Spain and Italy. According to Europol, the crime operation used phishing, SIM swapping and BEC attacks and it’s estimated that this led to profits of around €10 million ($11.7 million) during last year alone. Described as “very well organised”, the group included a number of experts in computer crime tasked with creating phishing domains and carrying out cyber fraud. Other individuals involved in the criminal network included money mules and money laundering experts, including experts in cryptocurrency. Working out of the Canary Islands, Spain, the criminals tricked victims – mostly from Italy – into sending large sums of money to bank accounts they controlled, before laundering the proceeds through money mules and shell companies. Business Email Compromise is one of the most lucrative forms of cyber crime, costing businesses billions a year, according to the FBI.  In addition to 106 arrests, 118 bank accounts have been frozen and a number of devices have been seized, including 224 credit cards, SIM cards and point-of-sale terminals.  

Police were investigating the group for over a year before making arrests. As part of the operation, Europol deployed two analysts and one forensic expert to Tenerife, Spain and one analyst to Italy. Europol also funded the deployment of three Italian investigators to Tenerife to support the Spanish authorities during the action day. MORE ON CYBERSECURITY More

ExpressVPN has been all over the news for the past week, and not in a good way. Because we recommend ExpressVPN here at ZDNet as one of the top VPNs out there, I’ve gotten a flood of reader questions asking for an objective read on the news. In this article, I’ll do my best. Sitrep Let’s start with a sitrep (situation report). There are two key items which are tangentially related.

ZDNet Recommends

The first item is that Kape Technologies has announced plans to acquire ExpressVPN for $986 million. I do have concerns about this because Kape was once considered a malware provider. I’ll talk more about this in a bit. The second item is a report in Reuters indicating that ExpressVPN CIO Daniel Gericke is among three men fined $1.6 million by the US Department of Justice for hacking and spying on US citizens on behalf of the government of the UAE (United Arab Emirates).I’ll discuss each of these reports individually, and then share with you some thoughts about how these situations might impact your decision to use (or not use) ExpressVPN. Kape Technologies Kape Technologies has had quite a convoluted history. According to a report in Forbes, a company called Crossrider was formed in 2011 by “billionaire Teddy Sagi, a serial entrepreneur and ex-con who was jailed for insider trading in the 1990s. His biggest money maker to date is gambling software developer Playtech,” and Koby Menachemi. Menachemi was a developer for Unit 8200, an Israeli signals intelligence unit responsible for hacking and collecting data (think of it as part CIA, part NSA, and part high school, because the unit hires and trains teenagers in hacking and coding skills).

Crossrider’s business was ad injection. Remember back in the day when companies like Yahoo tried to convince you to download their browser extension with their search bar? Crossrider’s business was creating tools that allowed them to inject ads into other companies’ web pages, sometimes overriding even ads that were paid to run on the sites that were being compromised. Ad injection skirted the line between just being scummy and being malware. Forbes reported that Symantec’s anti-malware identified software based on Crossrider’s product as malware, in part because the product effectively stole the ad revenue from the sites its users visited, and in part because it collected whatever data it could find in the process. According to Publift, an ad partnering service founded by ex-Googlers, the ad injection business is still out there. But Google has been fighting it for about five years now, meaning it’s not nearly as lucrative a business as it once was. According to a 2018 report in the Israeli business daily Globes, Kape Technologies was a rebranding effort on the part of then relatively new Crossrider CEO Ido Erlichman. Crossrider’s share price had fallen to a low of £0.27 on the London Stock Exchange and the company was seeking a new strategy. What better strategy for a company dedicated to siphoning users’ data and eyeballs than to branch out into the one area of cybersecurity where users are obsessed with anonymity and information security? You can cut the irony with a knife. In any case, the newly renamed Kape Technologies set out on an acquisition binge. The company started buying in 2017, acquiring CyberGhost VPN for about $9 million. Next, in 2018, came Mac antivirus company Intego for $16 million. A few months later, Kape gobbled up another VPN provider, ZenMate, for about $5 million. A year later, in 2019, Kape spent $95 million for Private Internet Access, one of the best known VPN providers at the time. After a 2020 IPO on the London Stock Exchange (which raised $115 million), and a year of record earnings where the pandemic and work-from-home cybersecurity concerns drove VPN demand, Kape was riding high. Back in March of this year, the company bought Webselenese for $149 million. This is worthy of further discussion. At first glance, it’s tough to pin down what Webselenese does. The company describes itself as “an online platform specialising in consumer-focused privacy and security content.” What does this mean? According to investment site The Twenties Trader, Webselense owns two very high profile review sites, VPNMentor and Wizcase. According to Alexa (Amazon’s traffic monitoring service, not Amazon’s voice assistant — I know, it’s confusing), VPNMentor has a rank of 5,807. Wizcase has a rank of 7,280.

Are you seeing where this is going? Adware provider pivots to become a provider of VPN services, then that company buys up two of the largest VPN review sites on the internet. Does anyone think those reviews will remain unbiased? According to site RestorePrivacy.com (which itself traffics in VPN reviews), VPN rankings on both VPNMentor and Wizcase changed in Kape Technologies’ favor just as soon as Kape bought Webselenese. Can you spell “conflict of intererest?” Sure. I knew you could. And then, last week, Kape siphoned up ExpressVPN for $936 million, its biggest deal to date. With Kape’s somewhat sordid history, you can see the concern. I’ll mention one other issue about Kape, and then we’ll move on. Last year, my CNET colleague Rae Hodge did an extensive analysis of Kape Technologies. At the time, she was looking at Kape as it pertained to its ownership of CyberGhost. But one thing she pointed out should be a concern. She pointed out that even after the change from Crossrider to Kape, “Kape still operated the infamous scareware Reimage — a potentially unwanted program that positions itself as a computer performance enhancer but which has been known to signal false positives on security threats in order to persuade you to pay for its premium service.” She also pointed out that as recently as 2019, “new Crossrider-Kape mutations have been cropping up on the web.” So, there’s that. Now let’s get to know Daniel Gericke a little better. ExpressVPN CIO Daniel Gericke Last week, as a completely separate story from Kape’s acquisition of ExpressVPN, Reuters reported that, “Three former U.S. intelligence operatives who worked as cyber spies for the United Arab Emirates admitted to violating U.S. hacking laws and prohibitions on selling sensitive military technology.” They were Marc Baier, Ryan Adams, and…Daniel Gericke. Gericke, as it turns out, is also ExpressVPN’s CIO. Baier, Adams, and Gericke were not good boys. They were hired guns for a special intelligence unit set up by the United Arab Emirates (UAE) to gather intelligence on journalists, activists, dissidents, and rival governments. According to some excellent in-depth reporting by Reuters, Raven was a substantial project, using money from Arab royalty to hire at least a dozen former NSA and CIA operatives to hack into networks in the US and other countries on behalf of their clients. Remember Project Raven. We’ll come back to that in a bit, with even more irony. Unfortunately, Gericke doesn’t have a profile on LinkedIn. There is a profile for a Daniel Gericke listing his sole position as “IT Director at Professional Corporation,” so if that’s our Daniel, it’s not much to go on. The most we know is in the 1,563-word statement issued by ExpressVPN regarding Mr. Gericke. ExpressVPN said it hired him in 2019. It did not say whether he was still doing work for Project Raven or the UAE at that time.

If you’re deeply interested in this, the best thing to do is read ExpressVPN’s statement. It’s a bit of a marvel. It goes on to say that the company knew Gericke was involved in spy stuff, but did not know about anything illegal, immoral, or fattening. The company explains that it’s necessary to hire someone “steeped and seasoned in offense” in order to build the best defenses. Then it goes on to state how it protected its services from corruption from within and have subsequently hardened its services from external attack. As of September 17, the company reaffirmed its support of Gericke and did not indicate any plans to terminate him. Edward Snowden and his glass house Y’all remember Edward Snowden? Back in 2013 and 2014, Snowden used up a lot of my column inches. For those of you doomed to forget history, Edward Joseph Snowden was a former NSA employee and CIA contractor who stole and then leaked more than a million top secret documents from the governments of the United States, Australia, and Great Britain. After the leak, he ran from the US to Hong Kong, and then from Hong Kong to Russia, where he received asylum after living in the Sheremetyevo Alexander S. Pushkin International Airport for about 40 days and 40 nights. In 2020, Snowden applied for and was granted permanent residency in Russia. He then went on to apply for dual Russian-American citizenship in December of that year. In his years subsequent to his theft and escape to Russia, Snowden has made quite the name for himself. A movie was based on his exploits. And he makes a living doing remote speaking engagements for willing and credulous audiences. So how did Mr. Snowden wind up in our story? As it turns out, he weighed in on ExpressVPN and Daniel Gericke when the news broke last week. On September 15, he tweeted, “If you’re an ExpressVPN customer, you shouldn’t be.” This came out the day after the Reuters report on Gericke and ExpressVPN and was picked up by media sources across the internet. You’ve probably heard the phrase, “people who live in glass houses shouldn’t throw stones.” Well, here’s Snowden’s glass house. According to Reuters’ in-depth report on Project Raven, two months before Snowden’s fateful theft of US government top secret information, he was recommended for work at military contractor Booz Allen Hamilton (which then subcontracted him out to the three letter agencies) by Lori Stroud, who herself was later recruited to Project Raven by Marc Baier. Baier worked at NSA Hawaii along with Snowden. Baier was also one of the three men indicted by the Justice Department along with ExpressVPN’s Gericke. So, as we wade deeper in irony, we have a former NSA operative who stole millions of documents from the US Government and ran to Russia, who is complaining about the employer of a former colleague of a former colleague, both of whom were involved in shady activities, but nothing as vastly criminal as his own actions. What now? Okay, so now you’re up to date. You know about the company that just acquired ExpressVPN and its somewhat shady past and, at the very least unethical juking of the stats when it comes to VPN reviews. You know about the  background of ExpressVPN’s CIO. But what of ExpressVPN itself? The key question is, should you use it or skip it? What I use One of the most frequently asked questions I get is which VPN service I use. This week, it’s been all about whether I’m going to stop using ExpressVPN as my VPN service. Here’s the hard truth: I don’t use a commercial VPN service. I don’t like the idea of my data going through any of the VPN players’ servers. But I’m a bit of an outlier. I’ve long run my own bare-metal Linux VPN server network located across a few cloud infrastructure providers. I’ve been hacking my own Linux kernel mods for years, and I’m just as comfortable spinning up a series of servers that bounce traffic as I am making a cup of coffee in the morning. I do test all the VPN services I review, but only for a limited time, and only on dedicated test machines. Any that I have concerns about have been documented in my reviews. So far, at least among the top players, I haven’t found anything much worse than a VPN connection indicating that the connection is routing through a VPN. But it’s important to note that I personally only use a VPN for communication security at airports, hotels, and coffee shops — which I’m visiting a whole lot less these days. I don’t have any need to obfuscate my location in order to illegally route around sports viewing restrictions, or to cheap out and not pay for new episodes of Star Trek Discovery or Picard. I am also not a dissident, or someone running from an abusive relationship. I don’t do financial transactions online when away from my home network. As such, I don’t need all the services and all the clients offered by many of the VPN service providers I’ve profiled. None of the VPN services I recommend are bad — I just don’t need them in my day-to-day life because I built my own. But what about ExpressVPN? What about ExpressVPN? Do these revelations change anything? To answer that for yourself, you’ll need to ask yourself three questions. How good is ExpressVPN for my needs? When I looked at ExpressVPN, I called it “an easy-to-use VPN with middle-of-the-road everything.” I did find that an ExpressVPN connection routed through Security Firewall Ltd, a firm with a surprisingly high Google fraud rating. ExpressVPN reached out to say that Security Firewall is just one of many companies it leases infrastructure from, and its network is secure. You can read the company’s statement in my review.Also: ExpressVPN review: A fine VPN service, but is it worth the price?

Overall, I didn’t find that ExpressVPN was the fastest or the cheapest VPN, but it did have great documentation, support for a whole lot of clients, a nice user interface, and was easy to setup. So, from a functional point of view, it’s fine. Not great, but generally good enough. Will the Kape acquisition change things? Kape has genuinely been going hard after acquiring cybersecurity companies. I’d be comfortable with its pivot (we all did things in the past we regret) if it weren’t for the Webselenese acquisition this year. Acquiring those review sites for $149 million just has terrible optics. I reviewed both CyberGhost and Private Internet Access well after their acquisition by Kape, and both products were good. Also:  Kape has had a past that’s at odds with the mission of a VPN provider. Kape, back when it was Crossrider, liked to hoover up users’ data, probably to sell to advertisers. Will it continue to do so? I don’t know, but it’d be really foolish if it did. The VPN market is a vastly more profitable business than ad informatics, and Kape’s VPN brands are now its golden geese. It’d be insane to risk those cash cows (I know, the mixed metaphor hurts), in favor of selling out its users’ data. What about keeping Gericke on staff? The company’s blog post went to great lengths to show how it is restricting Gericke’s access so he won’t do baaaad things. But I agree with the premise that you need some offensive warriors when you’re at war. I’m not sure Gericke should stay as the company’s CIO with any infrastructure responsibility, but keeping a stable of folks who know and understand the enemy is important in this business. So what’s the bottom line? One thing I’m asked regularly is whether or not ExpressVPN (or any other VPN) is going to share information with the FBI (or name your favorite intelligence agency). The prevailing wisdom is that VPN vendors located outside the various “Eyes” intelligence sharing treaties are somehow safer for those hiding information from government access. This is generally not true. As I discussed in my analysis of NordVPN, most VPN providers have enough of a footprint in MLAT treaty countries that if a three-letter agency wants your information, it’ll get it. So, unless you’re a very serious dissident (or, I guess, a criminal) on the run from the government, the whole issue of jurisdiction is merely VPN theatre for the benefit of good marketing hype. And if you are relying on a VPN service to protect your life and freedom, why are you relying on something you read online for your truth? I just showed you that the biggest VPN review sites are owned by a VPN conglomerate. You need to do some very serious investigation and testing on your own, if you want to be truly safe. If you’re currently using ExpressVPN for general-purpose safe computing (like checking your mail at the local coffee shop) and you like it, I wouldn’t say you should give it up. If you’re relying on any of the Kape brands for a life and death situation, I’d say it’s probably not worth the risk. If you’re shopping for a VPN, read all the reviews and try them out. Most give you thirty days, so see how they actually work for you. Again, I wouldn’t necessarily dismiss ExpressVPN out of hand because of these reports, but it’s up to you to gauge your risk level. In the mid-1980s, US president Ronald Wilson Reagan was preparing for a summit with Soviet president Mikhail Sergeyevich Gorbachev and wanted to bond with his Soviet counterpart. When Reagan spoke with Russian history scholar Susanne Massie, an American, she introduced him to the phrase doveryai, no proveryai. In English, that’s trust, but verify. Reagan apparently liked the phrase so much, he overused it, much to the annoyance of Gorbachev. In any case, that’s how I recommend approaching ExpressVPN: trust, but verify. We’ll keep an eye on how the company behaves. Does Kape do anything else that indicates their moral compass is askew? Does Gericke’s access become more limited or does he leave the company? Does data secured by ExpressVPN turn out to be less secure? I don’t believe we need to pillory ExpressVPN just yet. All the bad news is tangential to its operations. But I’d advise the company to walk very carefully, to hold its new masters at Kape accountable, and to both know where the line is and stay firmly on the angels’ side of that line. You can follow my day-to-day project updates on social media. Be sure to follow me on Twitter at @DavidGewirtz, on Facebook at Facebook.com/DavidGewirtz, on Instagram at Instagram.com/DavidGewirtz, and on YouTube at YouTube.com/DavidGewirtzTV. More

Android apps that haven’t been used for a while will soon begin to automatically lose their permission to access sensitive device features, such as sensors, SMS messages, and contact lists. Come December, Google plans to ramp up the availability of “permissions auto-reset”, an Android privacy feature that automatically winds back an app’s previously-granted permissions to access a device’s location, camera, microphone and so on.  Google released the feature for Android 11 last year, but in December it will expand it to “billions more devices” via Google Play services on devices running Android 6.0 (API level 23) from 2015 and newer.   

“The feature will be enabled by default for apps targeting Android 11 (API level 30) or higher. However, users can enable permission auto-reset manually for apps targeting API levels 23 to 29,” Google explains in an Android developer blogpost.  SEE: Over 60 million wearable, fitness tracking records exposed via unsecured database The feature aims to help Android users control privacy-sensitive app permissions in the context of users having dozens of apps on a device, many of which don’t get used that often or for long periods of time. It targets an app’s “runtime permissions”, or “dangerous permissions” for accessing location, contact information, messages and other private user data.     Around Q2 2022, if an app targets Android 6 or higher and isn’t used for a few months, Android will automatically reset the sensitive runtime permissions that the user had granted to an app. 

“This action has the same effect as if the user viewed a permission in system settings and changed your app’s access level to Deny,” Google explains in developer notes.  The change will affect all Android apps on consumer devices. However, Google has made an exception for enterprise-managed apps and apps with permissions that have been fixed by enterprise policy.  Google also has a way for developers to ask a user to disable auto-set for their app. This could be suitable for apps that are expected to work in the background, such as apps that provide family safety, apps for syncing data, apps for controlling smart devices or pairing with other devices. SEE: Smartphone sales are riding out the global chip shortage The rollout of the auto-reset feature will gradually take place after kicking off in December, but it won’t reach all devices between Android 6 and Android 10 until Q1 2022, Google notes.  However, users with Android 6 to 10 can go to an auto-reset settings page and enable or disable auto-reset for specific apps. “The system will start to automatically reset the permissions of unused apps a few weeks after the feature launches on a device,” Google notes.  More

Facebook has criticized a series of investigations published by the Wall Street Journal as containing “deliberate mischaracterizations” which “confer egregiously false motives to Facebook’s leadership and employees.”

Recently, the WSJ has published “The Facebook Files,” a set of articles based on a review of the social media giant’s internal documents, research, draft presentations, and online employee discussions.  Among the reports is an allegation made by the news outlet that the company knows its platforms — including Facebook and Instagram — are “riddled” with flaws that “cause harm, often in ways only the company fully understands” and these alleged issues are known all the way up to the chief executive, Mark Zuckerberg. Among its reports, the WSJ says that changes made by Facebook to its algorithms three years ago to improve user connectivity and well-being made the platform “angrier” instead, with staff members warning of the potential damage being done. Changes were then allegedly resisted due to concerns surrounding declining user engagement.  In addition, the publication says that researchers inside Instagram have found that the app is “harmful” and “toxic” for some younger users; in particular, teenage girls.  “In response, Facebook says the negative effects aren’t widespread, that the mental-health research is valuable and that some of the harmful aspects aren’t easy to address,” the WSJ says.  Furthermore, an alleged internal platform known as cross check/XCheck exempts some high-profile users from the rules applied to typical users, which shields these individuals from sanctions normally applied when material is posted that may break Facebook terms of service, such as posts inciting violence. 

In response, former UK politician and now Facebook Vice President of Global Affairs Nick Clegg said in a blog post on Saturday that the series “contained deliberate mischaracterizations of what we are trying to do, and conferred egregiously false motives to Facebook’s leadership and employees.” Clegg also says that the accusation at the core of the reports, that Facebook conducts research and dismisses anything that is not of benefit to the company, “is plain false” and is based on the “cherry-picked” selection of leaked documents. “With any research, there will be ideas for improvement that are effective to pursue and ideas where the tradeoffs against other important considerations are worse than the proposed fix,” the executive says. “The fact that not every idea that a researcher raises is acted upon doesn’t mean Facebook teams are not continually considering a range of different improvements.” Clegg also referenced one of the WSJ’s reports on how COVID-19 misinformation and “barrier to vaccination” content has been handled over the course of the pandemic. The publication writes that anti-vaxxers have been able to abuse Facebook’s own tools to sow doubt, flooding the platform with negative comments and potentially undermining initiatives to drive up vaccine acceptance rates.  The executive says that health organizations continue to post because despite negative commentary, by their own measurements, promotion is still effective.  “Facebook understands the significant responsibility that comes with operating a global platform,” Clegg says. “We take it seriously, and we don’t shy away from scrutiny and criticism. But we fundamentally reject this mischaracterization of our work and impugning of the company’s motives.”  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Image: Victorian Government
The Victorian government has launched a new five-year cyber strategy that will see over AU$50 million be allocated towards bolstering the state’s cybersecurity resilience. The cyber strategy [PDF] will focus on three core missions that government has described as providing safe and reliable delivery of government services, creating a cyber safe place, and creating a “vibrant” cyber economy. The strategy will be implemented through the state’s chief information security officer (CISO) releasing annual mission delivery plans that outline specific activities associated with the three core missions. The CISO will develop this plan in consultation with relevant stakeholders across government, industry, and the community. The CISO will also publish an annual statement on the progress of activities against each of the three core missions. While the first annual mission delivery plan is yet to be released, Minister for Government Services Danny Pearson said the first year of the cyber strategy will see government specifically focus on strengthening security for government online services and communications. It will also provide more opportunities to grow the state’s local cybersecurity talent, Pearson said. As part of the mission of improving the delivery of government services, the actions to be rolled out by government will entail creating an IT asset management guideline that is in line with Victorian Protective Data Security Framework requirements; decommissioning unused services currently active on vic.gov.au domains; and establishing a whole-of-government third-party risk program.

It also includes deploying a status monitoring program and simple procurement process that both follow Essential Eight guidelines; working with the National Cyber Security Committee to standardise government third-party supplier security frameworks; and building various guidelines and cyber education programs aimed at improving the resilience of government’s critical services. For the mission of making Victoria more cyber safe, the state government will establish a Victoria Police Cybercrime Strategy to boost Victoria Police capability and a new expert advisory panel focused on understanding cybercrime risks. The advisory panel will report to government on opportunities to enhance cybercrime messaging and education programs as well as potential legislative reform for helping police combat cybercrime, the strategy outlines.Government will also develop an annual cyber exercise program in partnership with Victoria’s critical infrastructure owners and operators as part of the strategy’s second mission. The third mission, creating a “vibrant” cyber economy, will see the Victorian government allocate investment towards growing local cyber capability, create internship and training programs in the cyber sector, and establish an expert advisory panel to provide insight on cyber capability uplift opportunities and digital economic growth.The new cyber strategy builds on Victoria’s AU$196 million plan, announced late last year, to centralise and simplify the state’s IT services. Related Coverage More

There are few things cooler than multiple displays that make multi-tasking a breeze. However, while that’s not an uncommon setup at home, it’s hasn’t been easy to take on the road — until now. The Mobile Pixels TRIO gives you not one, but two extra displays for your laptop.It has a light, compact design that makes it easy to take anywhere, and conveniently has just one cable that can be used for both data and power. The TRIO has a full 270° rotation and the brightness can be adjusted to your liking.Amazon buyers rate it 4.2 out of 5 stars and it’s been featured on WIRED, Buzzfeed, and more. Students, working professionals, programmers, gamers, and more will love the Mobile Pixels TRIO. If you’re a digital nomad, you can learn a new language on one screen with your work on a second and email on the third.

Of course, if you’re using mobile accessories, it’s a good indication that you’ll be on public wifi at least now and then. So you need powerful VPN protection, which is exactly what VPN Unlimited: Lifetime Subscription offers. Your security and privacy are ensured by military-grade encryption and a zero-log policy. A kill-switch is included to disconnect you from the internet if your connection to a KeepSolid VPN server drops.If you happen to be traveling abroad, you’ll appreciate that KeepSolid has more than 400 servers placed around the globe, because that means no geo-restrictions when it comes to watching your favorite content. The service also includes unlimited speed and bandwidth, so there is no lagging or buffering while you’re streaming.You get 24/7 support, but KeepSolid is very user-friendly. It also has additional convenient features such as Trusted Networks, Favorite Servers, Ping Tests, and a lot more. KeepSolid VPN is the best-selling VPN of all time, with over ten million users worldwide. A VPN Special review illustrates KeepSolidVPN’s advantages quite nicely: “KeepSolid VPN Unlimited offers amazing services and its advanced features makes it a solid VPN service provider.”

Don’t miss this chance to get a lifetime of powerful VPN protection and two portable displays for your laptop. Grab The VPN Unlimited Lifetime Subscription + Mobile Pixels TRIO Bundle today while you can use Coupon SCREEN285 to get a 25% discount off the $699 retail price and pay only $519. More

US customer experience technology giant TTEC has announced a “cybersecurity incident” but confirmed to employees that it was hit with ransomware.The company, with nearly 61,000 employees and billions in annual revenue, sent a message to employees this week warning them not to click on a link titled “!RA!G!N!A!R!” according to KrebsonSecurity. The message indicates the attack may have been launched by the prolific Ragnar Locker ransomware group or someone trying to impersonate them. TTEC told employees that it was having system outages and was working to remove the malicious “!RA!G!N!A!R!” file from its system.In a statement to ZDNet, TTEC corporate communications vice president Tim Blair would not confirm that it was a ransomware incident but said some of the company’s data was encrypted and “business activities at several facilities have been temporarily disrupted.””TTEC immediately activated its information security incident response business continuity protocols, isolated the systems involved, and took other appropriate measures to contain the incident,” Blair said. “We are now in the process of  carefully and deliberately restoring the systems that have been involved. We also launched an investigation, typical under the circumstances, to determine the potential impacts. In serving our clients TTEC generally does not maintain our clients’ data, and the investigation to date has not identified compromise to clients’ data. That investigation is on-going and we will take additional action, as appropriate, based on the investigation’s results.”TTEC works with some of the biggest companies in the world, including Verizon, Best Buy, Dish Network, Bank of America and Kaiser Permanente.

KrebsonSecurity was able to obtain the internal message from a reader, who told the blog that the “widespread” system outage began on Sunday, September 12. The source told KrebsonSecurity that thousands of TTEC employees working on accounts for Verizon, Kaiser Permanente and Bank of America were unable to do any tasks because of the attack while many other customer support teams reported being unable to work. Ransomware groups typically target organizations with large customer bases that rely on services or a product, knowing it hinders business and creates a trickle-down impact on all customers, KnowBe4 security advocate James McQuiggan said. “Ransomware attacks have been known to hinder the business and steal intellectual property, client information and employee information. The cyber criminals then use this information to extort the employees or customers for additional money or be in fear of their data being released publicly,” McQuiggan said.The Ragnar Locker ransomware group has been in the news as of late for their comments about victims who contact the police or professional negotiators. On their darknet leaksite, the group said it would destroy decryption keys and publish all sensitive data that was stolen if victims dared to contact cybersecurity companies or law enforcement. “So from this moment we warn all our clients, if you will hire any recovery company for negotiations or if you will send requests to the police/FBI/investigators, we will consider this as a hostile intent and we will initiate the publication of whole compromised data immediately,” the group said, according to a note seen by BleepingComputer.The group has previously attacked major companies like Capcom, Campari, energy company EDP, game studio CD Projekt Red and a number of shipping giants in China.  More

Image: Daniel Romero via Unsplash
My iPhone offers pretty good connectivity, but tends to be hamstrung by the limits imposed by my cellular carrier. Even though I have an unlimited data plan, using my phone as a hotspot is limited to a very short amount of time before I start to rack up extra fees. When traveling, and working for a few hours every night in a hotel lobby or coffee shop, my so-called unlimited hotspot service just won’t cut it. That means I’ve had to rely on local Wi-Fi for both my iPhone and iPad. Let me put it bluntly: using a local hotel, airport, school, or coffee shop Wi-Fi is terrifying. There’s no telling what’s monitoring traffic, and even if the hotel has encrypted Wi-Fi, you never know what’s running on that network. That’s why running a VPN is essential, and I’ve long recommended having a VPN service that works with both your iPhone and iPad — I tend to use both extensively while on the road. In this article, we’re looking at four VPN services we’ve come to know over the years, who offer solid iPhone and iPad clients and good performance. Let’s take a look at each.

4.6 App Store average, 219K ratings

Simultaneous Connections: 6Kill Switch: YesPlatforms: Windows, Mac, iOS, Android, Linux, Android TV, Chrome, FirefoxLogging: None, except billing dataCountries: 59Servers: 5517Trial/MBG: 30 dayAlso: How does NordVPN work? Plus how to set it up and use itNordVPN is one of the more popular VPN offerings on the iPhone App Store. Installation on the iPhone is simple and painless, and performance is predictable across regions.Also: My in-depth review of NordVPNIn our review, we liked that it offered capabilities beyond basic VPN, including support of P2P sharing, a service it calls Double VPN that does a second layer of encryption, Onion over VPN which allows for TOR capabilities over its VPN, and even a dedicated IP if you’re trying to run a VPN that also doubles as a server. It supports all the usual platforms and a bunch of home network platforms as well. The company also offers NordVPN Teams, which provides centralized management and billing for a mobile workforce.Also: My interview with NordVPN management on how they run their servicePerformance testing was adequate, although ping speeds were slow enough that I wouldn’t want to play a twitch video game over the VPN. To be fair, most VPNs have pretty terrible ping speeds, so this isn’t a weakness unique to Nord. Overall, a solid choice, and with a 30-day money-back guarantee, worth a try.

4.6 App Store average, 142.2K ratings

Simultaneous Connections: 5 or unlimited with the router appKill Switch: YesPlatforms: A whole lot (see the full list here)Logging: No browsing logs, some connection logsCountries: 94Locations: 160Trial/MBG: 30 daysExpressVPN supports iOS back to iOS 12. Phones supported include iPhone 12, iPhone 12 Mini, iPhone 12 Pro, iPhone 12 Pro Max, iPhone 11, iPhone 11 Pro, iPhone 11 Pro Max, iPhone SE (2nd generation), iPhone XS, iPhone XS Max, iPhone XR, iPhone X, iPhone 8, iPhone 8 Plus, iPhone 7, iPhone 7 Plus, iPhone SE, iPhone 6, iPhone 6S, iPhone 6S Plus. iPads supported include iPad, iPad Pro, iPad Air, iPad Air 2, iPad Mini, iPad Mini 2, iPad Mini 3, iPad Mini 4ExpressVPN is one of the most popular VPN providers out there, offering a wide range of platforms and protocols. In addition to iOS, platforms include Windows, Mac, Linux, routers, Android, Chromebook, Kindle Fire, and even the Nook device. There are also browser extensions for Chrome and Firefox. Plus, ExpressVPN works with PlayStation, Apple TV, Xbox, Amazon Fire TV, and the Nintendo Switch. There’s even a manual setup option for Chromecast, Roku, and Nvidia Switch.Must read:With 160 server locations in 94 countries, ExpressVPN has a considerable VPN network across the internet. In CNET’s review of the service, staff writer Rae Hodge reported that ExpressVPN lost less than 2% of performance with the VPN enabled and using the OpenVPN protocol vs. a direct connection.While the company does not log browsing history or traffic destinations, it does log dates connected to the VPN service, amount transferred, and VPN server location. We do want to give ExpressVPN kudos for making this information very clear and easily accessible.Exclusive offer: Get 3 extra months free.

4.5 App Store average, 77.2K ratings

Simultaneous Connections: UnlimitedKill Switch: YesPlatforms: Windows, Mac, iOS, Android, Linux, Chrome, plus routers, Fire Stick, and KodiLogging: None, except billing dataServers: 1,500 Locations: 75Trial/MBG: 30 dayIPVanish is a deep and highly configurable product that presents itself as a click-and-go solution. I think the company is selling itself short doing this. A quick visit to its website shows a relatively generic VPN service, but that’s not the whole truth.Also: My in-depth review of IPVanishIts UI provides a wide range of server selection options, including some great performance graphics. It also has a wide variety of protocols, so no matter what you’re connecting to, you can know what to expect. The company also provides an excellent server list with good current status information. There’s also a raft of configuration options for the app itself.IPVanish provides even more iOS support than ExpressVPN, supporting devices back to iOS 11. That provides support for iPhones back to the iPhone 5s, the iPad mini 2, and the original iPad Air.In terms of performance, connection speed was crazy fast. Overall transfer performance was good. However, from a security perspective, it wasn’t able to hide that I was connecting via a VPN — although the data transferred was secure. Overall, a solid product with a good user experience that’s fine for home connections as long as you’re not trying to hide the fact that you’re on a VPN.The company also has a partnership with SugarSync and provides 250GB of encrypted cloud storage with each plan.

4.4 App Store average, only 4.3K ratings

Simultaneous Connections: UnlimitedKill Switch: YesPlatforms: Windows, Mac, Linux, iOS, Android, Fire TV, Firefox, ChromeLogging: None, except billing dataTrial/MBG: 30 dayAt two bucks a month for a two-year plan (billed in one chunk), Surfshark offers a good price for a solid offering. In CNET’s testing, no leaks were found (and given that much bigger names leaked connection information, that’s a big win). The company seems to have a very strong security focus, offering AES-256-GCM, RSA-2048, and Perfect Forward Secrecy encryption. Surfshark also offers iOS support for phones going back as far as the iPhone 5s.Must read:Surfshark’s performance was higher than NordVPN and Norton Secure VPN, but lower than ExpressVPN and IPVanish. That said, Surfshark also offers a multihop option that allows you to route connections through two VPN servers across the Surfshark private network. We also like that the company offers some inexpensive add-on features, including ad-blocking, anti-tracking, access to a non-logging search engine, and a tool that tracks your email address against data breach lists.

Isn’t iCloud+ Private Relay a VPN? Why do I need another VPN?

So let’s be clear. iCloud+ Private Relay is a feature of iCloud+, coming sometime in late 2021. If you buy any iCloud storage, you’ll get the iCloud+ features. But while Private Relay can hide your email address and location, it only does it when you’re using Safari. If you’re using Chrome (or any applications that use the Internet directly), you’re out of luck. It also shows up as proxy server so if you don’t want anyone to know you’re using a VPN, you’re out of luck. You also can’t change or hide your location, as you can with a full VPN. Private Relay is a feature of iCloud+. A VPN is a full security solution.

Do I need a VPN if I just use my carrier’s data?

Maybe. That depends on how much you trust your carrier — and wireless signals have been intercepted. You’re better off encrypting your data when it’s in motion, whether you use Wi-Fi or a carrier connection.

Doesn’t iOS include VPN services in the OS?

Yes, if you’re connecting to a corporate VPN server, as detailed here. But if you’re connecting to other destinations on the internet, you’re probably going to want to use a commercial VPN service.

You can follow my day-to-day project updates on social media. Be sure to follow me on Twitter at @DavidGewirtz, on Facebook at Facebook.com/DavidGewirtz, on Instagram at Instagram.com/DavidGewirtz, and on YouTube at YouTube.com/DavidGewirtzTV. More