Information Technology

[embedded content]
An unidentified hacker has accessed the computer systems for the water treatment facility in the city of Oldsmar, Florida, and has modified chemical levels to dangerous parameters.
News of the attack was disclosed today in a press conference by city officials.

ZDNet Recommends

The intrusion took place on Friday, February 5, when the hacker accessed a computer system that was set up to allow for the remote control of water treatment operations.
The hacker first accessed this system at 8 am, in the morning, and then again for a second and more prolonged intrusion at 1:30 pm, in the afternoon.
This second intrusion lasted for about five minutes and was detected right away by an operator who was monitoring the system and saw the hacker move the mouse cursor on the screen and access software responsible for water treatment.
Hacker modified lye levels
“Sodium hydroxide, also known as lye, is the main ingredient in liquid drain cleaners. It’s also used to control water acidity and remove metals from drinking water in the water treatment plant,” said Oldsmar Sheriff Bob Gualtieri.
“The hacker changed the sodium hydroxide from about 100 parts per million to 11,100 parts per million. This is obviously a significant and potentially dangerous increase.”

Oldsmar city staff said that no tainted water was delivered to local residents as the attack was caught in time before any lye levels could be deployed.
According to Sheriff Gualtieri, the hacker disconnected as soon as they modified the lye levels, and a human operator set the chemical level back to normal right away.
Officials didn’t attribute the attack to any specific hacker group or entity. The timing of the attack is also of note as the city of Oldsmar is located near the Tampa urban center, which hosted the Super Bowl LV game on Sunday.
Not the first time
This is the second incident of its kind where a hacker has accessed a water treatment facility and modified chemical levels.
A similar incident was reported back in 2015-2016 at an unnamed water treatment facility, but investigators said the intruders didn’t seem to know what they were doing, making random changes, and investigators classified the intrusion as an accident rather than an intentional attack.
Another set of attacks took place earlier this year, but without as dire consequences. In the spring and summer of 2020, Israeli officials reported attacks against local water treatment facilities, water pumps, and agricultural irrigation systems.
Tel Aviv officials, which blamed the attacks on the Iranian government, said hackers tried to access the management panels of several types of smart water management systems and asked local organizations to change their passwords.
None of the attacks were successful, officials and local media reported at the time. More

Although fewer of us are working out of airports, hotels, and coffee shops in these pandemic days, many of us are working outside of our employer’s facilities. This, along with the ever-increasing levels of cybercrime and hacking, is inspiring many people to install VPNs.
In a home environment, VPNs not only secure your connection from home to whatever online service you’re connecting to, but they also secure your connection from others on your Wi-Fi network. If you have confidential information you don’t want to share with roommates, or you’d prefer your teenager doesn’t have access to corporate, health, lifestyle, or financial information, a VPN will keep the connection from your computer, phone, or tablet secure from the prying eyes of the young digital natives in your midst.
In this article, we’ll present a few general installation and configuration guidelines. Then we’ll walk you, step-by-step, through the installation of four popular VPNs, one for each platform. We’ll be demonstrating how to install and setup NordVPN on iOS, IPVanish on MacOS, ExpressVPN on Windows 10, and Surfshark on Android.

Some quick tips
First and foremost, you must understand that your experience with a VPN will differ from others, especially those of us doing reviews. Every Internet connection performs differently, so even though we explored what VPNs are fastest, keep in mind that where you’re connecting from and what you’re connecting to will differ from the experience of other users. When choosing a VPN, make sure to take advantage of the trial time or the money-back guarantee. Definitely test before committing.
Second, you’ll need to decide if you want your VPN to always be on or only turn on when you tell it. If you want your VPN to be active from the moment the device boots up, make that selection in the preferences for your VPN application. If you want your VPN to be active only on occasion, turn off the enable-on-startup option for the VPN you’ve chosen.
Most modern VPN services have what’s called a Kill Switch. Some apps turn this on by default. Others have an option buried in preferences to enable it. What a kill switch does is disable your network connection if the VPN software fails. I generally recommend turning this on, because if you’re using a VPN, you want it to prevent others from seeing your data. You don’t want to take the chance that if it fails, your data will suddenly be unprotected.

NordVPN
As with all iOS apps, when it’s time to install a VPN on your iPhone or iPad, you’ll need to go to the App Store and find the application. For our iOS install example, we’ve chosen NordVPN. NordVPN scored our top slot in average aggregate scores among a field of nearly a dozen VPNs. It was one of the fastest VPNs, and its score was consistent across most testers on the Internet.
View Now at NordVPN
Also:

Now let’s look at the steps you’ll take installing a VPN on iOS:
When doing an iOS install, first launch the App Store and search for the VPN you want.
When you find the VPN you want, hit Get.
Next, authorize the download using Touch ID, Face ID, or your Apple password.
Once the app downloads, go ahead and launch it.
Most iOS VPN apps are similar from here. You may be asked permission to allow the app to send you alerts. I’d recommend approving this, because if your VPN has something important to tell you (usually about your connection), you probably want to know.
iOS also requires you to approve adding VPN functionality into the operating system. You’ll need to give the VPN approval, and also, probably, turn it on in the Settings panel.
Finally, decide whether you want the VPN to launch automatically when you boot up your phone.
If you want to see this process with NordVPN, take a look at the gallery below. We show you screenshot-by-screenshot steps for setting up an iOS VPN.

IPVanish
Unlike iOS, few popular VPNs are available in the MacOS app store. Instead, you’ll need to go to the VPN’s website and download the app, open the archive, and install it manually. For our Mac install example, we’ve chosen IPVanish. While IPVanish didn’t score near the top in terms of overall aggregate performance, we liked its relatively low ping time and quick time to make a connection. We also like the depth of control and options IPVanish offers, along with a very slick performance chart that constantly updates.
View Now at IPVanish
Also: IPVanish review: VPN delivers a wealth of options and browsing controls
Now let’s look at the steps you’ll take installing a VPN on a Mac:
When doing a Mac install, go to the VPN’s website. You may need to purchase or request a trial, and you may need to create an account.
Download the VPN’s installer.
Launch the installer or double-click the archive file. You’ll probably need to give MacOS permission to open it.
Installation may require you to run an installer or copy the application into your Applications folder. Do whichever fits your circumstances.
Most Mac VPN apps are similar from here. You may be asked for various permissions, including permission to run an app downloaded from the Internet and permission to install certain features. If you’re trying to install an app from a known VPN provider, go ahead and approve those requests.
Finally, decide whether you want the VPN to launch automatically when you boot up your Mac.
If you want to see this process with IPVanish, take a look at the gallery below. We show you screenshot-by-screenshot steps for setting up a Mac VPN.

ExpressVPN
As with Mac, few popular VPNs are available in the Microsoft Store. Once again, you’ll need to go to the VPN’s website and download the app, open the archive, and install it manually. For our Windows install example, we’ve chosen ExpressVPN. ExpressVPN was near the top in terms of overall aggregate performance, we liked its wide selection of device support. 
View Now at ExpressVPN
CNET: ExpressVPN review: This speedy VPN is worth the price
Now let’s look at the steps you’ll take installing a VPN on Windows:
When doing a Windows install, go to the VPN’s website. You may need to purchase or request a trial, and you may need to create an account.
Download the VPN’s installer. I prefer to download the installer file and then run it, rather than run it directly. I like being able to keep a copy of my installer files.
Launch the installer or double-click the archive file. You’ll probably need to give Windows permission to open it.
Most Windows VPN apps are similar from here. You may be asked by Windows Device Guard for various permissions, including permission to install certain features and send and receive data. If you’re trying to install an app from a known VPN provider, go ahead and approve those requests.
Finally, decide whether you want the VPN to launch automatically when you boot up Windows.
If you want to see this process with ExpressVPN, take a look at the gallery below. We show you screenshot-by-screenshot steps for setting up a Windows VPN.

Surfshark
Although you can certainly sideload some Android apps, you’re definitely safest (especially with VPNs) when you install a VPN from the Google Play store. For our Android install example, we’ve chosen Surfshark. Surfshark was a middle-of-the-road performer in our average aggregate scores among a field of nearly a dozen VPNs, but was rated as blazing fast by CNET’s review. This is why we always recommend you test to see how a VPN performs for you.
View Now at Surfshark
CNET: Surfshark VPN review: Competitive pricing and blazing speeds from this upstart service
Now let’s look at the steps you’ll take installing a VPN on Android:
When doing an Android install, first launch the Google Play store and search for the VPN you want.
When you find the VPN you want, tap Install.
Once the app downloads, go ahead and launch it.
Most Android VPN apps are similar from here. Android isn’t as fussy about permissions as iOS, but it does ask its fair share. You’ll need to give the VPN approval as requested during install and first operation.
Finally, decide whether you want the VPN to launch automatically when you boot up your phone.
If you want to see this process with Surfshark, take a look at the gallery below. We show you screenshot-by-screenshot steps for setting up an Android VPN.

And there you go. You’ve seen it’s pretty easy to set up a VPN for all four of the major platforms. Yes, I know I didn’t include Linux, but let’s face it: If you’re already running Linux, you don’t need me to tell you how to install a VPN (or anything else for that matter).
 Are you running a VPN? What service are you using, on what platforms? Let us know in the comments below.
You can follow my day-to-day project updates on social media. Be sure to follow me on Twitter at @DavidGewirtz, on Facebook at Facebook.com/DavidGewirtz, on Instagram at Instagram.com/DavidGewirtz, and on YouTube at YouTube.com/DavidGewirtzTV.

ZDNet Recommends More

Singapore is in the midst of rolling out tools and measures to plug several “IT weaknesses” highlighted in a report, including weak controls and inadequate reviews of privileged user activities. The report also stresses the need to mitigate new risks and vulnerabilities brought about by the accelerated rate of digital transformation amidst the global pandemic. 
Efforts already were underway to address the IT loopholes over the past year, with automation tools taking centrestage, according to the latest report by the Public Accounts Committee. These measures had been planned since last year, when the committee had chided the public sector for recurring IT lapses In its 2020 report. It then had also pointed to a lack of good standard operating procedures in user access rights management, with the logging and review of privileged user activities carried out manually. 

The committee added that controls over third-party vendors and partners could be beefed up. “Given the increasing pace of digitalisation and outsourcing of IT operations in the public sector, IT-related risks such as data security and cybersecurity risks will remain key risks for the government,” it noted in its report released Monday.
Efforts to plug the gaps were led by the Smart Nation and Digital Government Group (SNDGG), which underscored the importance of human supervision, changes in processes, and the adherence of these new processes alongside the implementation of automation and technological tools. 
The government agency said it was developing a centralised tool that would include the automation of the removal of user accounts that were no longer in use, which currently still needed to be checked manually despite the implementation of a new application that alerted agencies of staff movement and role changes. This platform had been deployed across 38 agencies since October 2019. 
Development of the centralised tool was targeted for completion by end-2021, after which agencies would integrate all existing systems with the centralised platform over the next three years. This would be deployed across high-priority systems by December 2023 and all remaining systems by December 2024, according to the SNDGG.
Another tool to aid in the review of privileged users’ activities also was slated to be deployed on high-priority systems by December 2022, following a pilot — launched last April — involving 15 government agencies. SNDGG reported that it was “refining” detection rules to monitor different types of logs, including operating systems, databases, networks, applications, and security as well as logic to improve the efficiencies of the detection system. Implementation would be progressively scaled up to all agencies from January 2021. 

Steps also had been taken to beef up organisational structures processes, which aimed to facilitate greater ownership so IT lapses would be addressed. In the area of data and cybersecurity, for instance, an agency’s chief security officer and chief data officer were required to report major cybersecurity and data issues directly to the agency’s head. 
In addition, all government agencies would tap audit and incident data to predict potential governance risks to IT systems. An initial batch of agencies were expected to begin a pilot for this in the first quarter of 2021, with deployment across the sector targeted for the second quarter. 
According to the Public Accounts Committee, new processes also had been put in place across the public sector to facilitate a “more coordinated and effective response” to data incidents. These included the establishment of the Government Data Security Contact Centre last April as an avenue for members of the public to report data incidents involving public agencies. 
From March 2021, all public agencies also would be required to conduct annual cyber and data security incident exercises.
Moving forward, the Public Accounts Committee noted that the accelerated digital transformation brought about by the COVID-19 pandemic could introduce risks and vulnerabilities. It said the SNDGG was probed about such risks and how the agency was mitigating them. 
In response, the smart nation group said it currently was setting up a government-wide “ICT and Smart System” enterprise risk management system, which would comprise a central office, risk owners, and integration of the framework with each agency’s own enterprise risk management processes. 
The SNDGG had identified 10 potential risks, but noted that most had been or were in the process of being addressed with ongoing efforts, including strengthening of agencies’ management of data security and cybersecurity risks as well as managing human capital risk. 
The Singapore government in February 2020 said it would invest SG$1 billion to beef up its cyber and data security systems, noting that this was essential as its agencies increasingly adopted technologies such as artificial intelligence, cloud, and Internet of Things. To be spent over the next three years, the funds would go towards readying the country to deal with cyber threats as digitisation efforts intensified. 
RELATED COVERAGE More

Image: Microsoft
Microsoft is working on adding a new security alert to the dashboard of Microsoft Defender for Office 365 (formerly Office 365 Advanced Threat Protection) that will notify companies when their employees are being targeted by nation-state threat actors.

The feature was added on Saturday to the Microsoft 365 roadmap website.
The idea behind the feature is not new. Since 2016, Microsoft began tracking nation-state hacking groups and the attacks they orchestrate against Microsoft email accounts.
If a user is targeted or compromised in one of these attacks, Microsoft sends them an email about the attack, along with basic advice they need to take to re-secure their inbox and devices.
Microsoft said in 2019 that it usually notifies around 10,000 users per year of nation-state attacks.
But the problem with this notification procedure is that it relies on users reading their email and taking action, which doesn’t always happen. Users don’t read their emails daily, or it might sometimes take hours before the user reaches the notification in crowded inboxes, a time during which attackers could use to steal sensitive documents.
For organizations who are customers of Microsoft’s Office 365 service, the OS maker now plans to add these notifications inside the dashboard of Microsoft Defender for Office 365, the cloud-based security platform that scans a company’s Office 365 accounts for threats.

This way, the notification will also appear for system administrators and security teams, who can act on it right away by calling the affected employees personally, resetting email account passwords, resetting other internal passwords, or by initiating a broader security audit.
The OS maker expects to have this feature ready by the end of the month.
Besides Microsoft, which does this for Microsoft Outlook email accounts, similar alerts for nation-state attacks are also available for Yahoo accounts, public Gmail accounts, and G Suite accounts. Facebook also warns users of nation-state attacks against its social media accounts. More

Image: Joshua C. Greenberg, MD, Mahmoud R. Altawil, MD,Gurjit Singh, MD
The new magnetic circular array introduced in iPhone 12 smartphones last year to support the MagSafe charging technology can disrupt implantable cardioverter-defibrillator (ICD) medical devices.
The warning comes from three cardiac electrophysiology doctors from the Henry Ford Heart and Vascular Institute at the Henry Ford Hospital in Detroit, Michigan.
In a letter published in a medical journal [PDF] last month, doctors warned that the new iPhone magnets could potentially “inhibit lifesaving therapy in a patient, particularly when the phone is carried in an upper chest pocket.”
These magnets, arranged in a circle, play a role in aligning the iPhone with a MagSafe charger for wireless charging operations.
Research published in 2009 has previously shown that any type of magnet, radio, or electronic equipment that generates a magnetic field stronger than 10 gauss can trigger internal systems inside ICD devices and stop their operations.
The Henry Ford Hospital doctors said they carried out tests with the new iPhone 12, released last year, and found that the new magnets are strong enough to trigger these switches.
“Once the iPhone was brought close to the ICD over the left chest area, immediate suspension of ICD therapies was noted and persisted for the duration of the test (Figure 1). This result was reproduced multiple times with different positions of the phone over the pocket,” the doctors said.

“Contemporary studies [1, 2] have shown minimal risk of electromagnetic interference from ICDs and older-generation smartphones not having a magnetic array.”
The new warning comes to supersede an Apple support page published last year on the same topic.
In that page, Apple estimated that even if iPhone 12 models contained more magnets, the new models were “not expected to pose a greater risk of magnetic interference to medical devices than prior iPhone models.”
The tech giant did advise users of implanted pacemakers and defibrillators that in order to “avoid any potential interactions,” they should keep their iPhones and MagSafe chargers at a safe distance from their implants of more than 12 inches (30 cm).
Furthermore, Apple said that if users suspected that their iPhone or any MagSafe accessories are interfering with their medical devices, they should stop using their iPhone or MagSafe accessories right away. More

TikTok, the video-sharing social network, drove a lot of interest from consumers last year. It also piqued their interest in Virtual Private Networks (VPNs), according to new research.
The research by Brooklyn, NY-based security advisors Security.org found that interest in VPNs was directly correlated with newsworthy events.

ZDNet Recommends

The company measured the amount of web traffic in a day compared to the average web traffic of a week prior to the date and correlated this with significant events during 2020.
VPN technology is used for various reasons. It can be used to create a secure channel to communicate with the workplace protecting sensitive business information, to bypass government restrictions, or to hide activity from Internet Service Providers amongst others.
Almost one in 10 US adult VPN users cite whistleblowing, activism, or bypassing government or organization restrictions as a reason for use of VPN technology.
Security.org’s research showed that interest in VPN technology tends to increase significantly whenever there is a newsworthy event that impacts travel, or internet usage, or impacts working from home environments.
Security.org
On March 22020, the first deaths due to COVID-19 were reported, leading to an increase in VPN interest of 99 percent compared with average web traffic the week before..

On March 24 2020 when the postponement of the Tokyo 2020 Olympics was announced, there was a 78 percent increase in consumers’ VPN interest.
This was due to people looking to secure their at-home networks for the possibility of stay-at-home orders and working from home due to the pandemic.
On August 13, average consumer interest in VPNs increased by 74 percent when President Trump proposed a ban on TikTok in August 2020. Interest also spiked by 34% on September 20th – the day the TikTok ban was said to start.
When internet censorship is threatened, average consumer interest in VPNs increases, and consumers flock to buy routers – like the GL.iNet Beryl router which has VPN software built in to the router.
A VPN will allow people to access the internet in countries where restrictions are in place. Countries with levels of internet censorship can bypass firewalls to get to otherwise-restricted content.
As restrictions on free content continue to grow, I think that more and more of us will switch to VPN technology. We can then ensure that we have the freedom to access the content we want to and to communicate as if there were no restrictions at all – wherever we happen to live. More

There’s been a huge increase in cyber criminals attempting to perform attacks by exploiting remote login credentials over the last year, as many employees continue to work from home.
Working from home has become a necessity for many and it’s only by remotely logging in to corporate VPNs and application suites that people are able to continue to do their jobs.

More on privacy

However, the rise in remote working has provided cyber criminals with a greater opportunity to slip into networks unnoticed by using legitimate login credentials – whether they are phished, guessed or otherwise stolen. By using legitimate login details instead of deploying malware, it’s easier for attackers to go about their business without being detected.
SEE: Cybersecurity: Let’s get tactical (ZDNet/TechRepublic special feature) | Download the free PDF version (TechRepublic)    
According to researchers at cyberscurity company ESET, that ease has led to a 768% growth in Remote Desktop Protocol (RDP) attacks over the course of 2020. In total, ESET detected 29 billion attempted RDP attacks across the year, as cyber criminals attempt to exploit remote workers.
In some cases, RDP ports are even misconfigured, providing attackers with even greater access to networks.
Either way, RDP attacks can be used to infiltrate networks to examine and steal sensitive information, while it can also be used as a means of gaining enough access to the network to deploy ransomware attacks.

This is all in environments that might be less protected than they would be if employees were working from within the office, rather than working remotely.
“RDP attacks are focusing on technology not on the human beings, thus require less handiwork from the attackers. Misconfigured RDP in many cases leads to valuable resources, such as company servers or devices with admin rights, that represent a springboard for further, often network-wide, compromises,” Ondrej Kubovič, security awareness specialist at ESET told ZDNet.
The ESET report notes that there was a drop off in RDP attacks during December, something that they’ve attributed to cyber criminals taking time off over Christmas. But it’s expected that 2021 will continue to see cyber criminals attempting to use RDP attacks to break into corporate networks, especially as employees continue to work remotely.
However, there are actions that organisations can take to make it much more difficult for cyber criminals to successfully compromise the network with RDP attacks.
SEE: Ransomware victims aren’t reporting attacks to police. That’s causing a big problem
IT security teams should encourage users to use strong passwords that are difficult to guess with brute force attacks. That password shouldn’t be used for any other accounts in order to lower the risk of compromise as a result of the password being leaked or breached elsewhere.
Applying two-factor authentication across the network will also go a long way to preventing cyber criminals conducting successful RDP attacks, as it’s much harder to get old of the extra layer of verification needed to access accounts.
Ensuring that users are using the latest versions of operating systems and software by having a solid patching strategy in place can also provide an additional layer of defence against attempted attacks.

MORE ON CYBERSECURITY More

With a single update, a popular barcode scanner app on Google Play transformed into malware and was able to hijack up to 10 million devices. 

ZDNet Recommends

Lavabird Ltd.’s Barcode Scanner was an Android app that had been available on Google’s official app repository for years. The app, accounting for over 10 million installs, offered a QR code reader and a barcode generator —  a useful utility for mobile devices. 
The mobile application appeared to be legitimate, trustworthy software, with many users having installed the app years ago without any problems — until recently. 
According to Malwarebytes, users recently started to complain of adverts appearing unexpectedly on their Android devices. It is often the case that unwanted programs, ads, and malvertising are connected with new app installations, but in this example, users reported that they had not installed anything recently. 
Upon investigation, the researchers pinpointed Barcode Scanner as the culprit. 
Malwarebytes
A software update issued on roughly December 4, 2020, changed the functions of the app to push advertising without warning. While many developers implement ads in their software in order to be able to offer free versions — and paid-for apps simply do not display ads — in recent years, the shift of apps from useful resources to adware overnight is becoming more common. 
“Ad SDKs can come from various third-party companies and provide a source of revenue for the app developer. It’s a win-win situation for everyone,” Malwarebytes noted. “Users get a free app, while the app developers and the ad SDK developers get paid. But every once in a while, an ad SDK company can change something on their end and ads can start getting a bit aggressive.”

Sometimes, ‘aggressive’ advertising practices can be the fault of SDK third-parties — but this was not the case when it comes to Barcode Scanner. Instead, the researchers say that malicious code was pushed in the December update and was heavily concealed to avoid detection.
The update was also signed with the same security certificate used in past, clean versions of the Android application. 
Malwarebytes reported its findings to Google and the tech giant has now pulled the app from Google Play. However, this doesn’t mean that the app will vanish from impacted devices, and so users need to manually uninstall the now-malicious app. 
Transforming clean SDKs into malicious packages is only one method employed to avoid Google Play protection, with time checks, long display times, the compromise of open source libraries used by an app, and dynamic loading also cited as potential ways for attackers to compromise your mobile device.
Another interesting method, spotted by Trend Micro, is the implementation of a motion sensor check. In 2019, Android utility apps were found to contain the Anubis banking Trojan which would only deploy once a user moved their handset. 
ZDNet has reached out to the developer and will update if we hear back. 

Previous and related coverage
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More