An Associated Press report has accused Google of recording the locations of its users via their mobile devices, even when they have requested not to be tracked by turning their “Location History” off.

Discovered

The apparent tracking without permission was discovered as part of research, when a Princeton privacy researcher noticed in his account that Google has tracked his many different locations along a route after he had been travelling for several days, despite his Location History being turned off.

Also, research has revealed that, even when Location History is paused / switched off, some Google apps store time-stamped location data without specifically asking your permission. For example, Google stores data about where you are when you simply open the Maps app, automatic daily weather updates on Android can discover roughly where you are, and some searches apparently unrelated to your location can also pinpoint your exact latitude and longitude, and save it to your Google account.

Could Affect Billions

It is thought that this could affect around two billion Android and Apple devices which use Google for maps or search.

What Is “Location History” and Why Have It Anyway?

According to Google, Location History is one of several ways to improve the experience of users, and works for features such as Google Maps e.g. if you agree to let Google Maps record your location over time, it will display that history for you in a “timeline” that maps out your daily movements.

Google says that Location History helps you to find the places you’ve been and the routes you’ve travelled. Google states that, when you choose to enable Location History, it records your location data and places in your Google Account, even when you’re not using Google Maps.

What’s The Problem?

The problem is that Google also states that “You can turn off Location History at any time. With Location History off, the places you go are no longer stored.”

Also, researchers have discovered that two things (rather than one) need to be opted-out in order to prevent tracking. Users need to disable both “Location History” and “Web & App Activity” in order to opt-out. Some commentators feel that this has not been made clear by Google.

The Issues

The issues with this are that:

– In the UK, for example, this may constitute a lack of transparency, openness and fairness under GDPR about what users are being told is happening to their data and what is actually happening.

– Users appear to have chosen to opt-out of something / not give their consent to something that relates to their privacy and the security of their personal data, and yet have not been opted-out completely by the company (possible issues of GDPR compliance).

– Some commentators have described it as ‘sneaky’ and it could certainly be an issue that affects the trust of users.

– Location data of this kind has been used by police (in the US) to track suspects, and could also potentially be used by other players e.g. cyber criminals if they had access to the user’s account. This could put users at risk.

– Location data can also be used to target people with location-based advertising. This may be something that users would like to avoid.

What Can You Do To Avoid Being Tracked In This Way?

The Associated Press has produced a guide which details what actions you can take to avoid being tracked by Google, even if your Location History on your mobile device is paused / turned off: The guide can be found here: https://www.apnews.com/b031ee35d4534f548e43b7575f4ab494/How-to-find-and-delete-where-Google-knows-you’ve-been

What Does This Mean For Your Business?

This story should be a reminder, particularly since the introduction of GDPR, that people value their privacy and security, and that businesses now have a strong legal responsibility to take this seriously. Transparency, fairness, and openness are vital when telling your customers what you’re doing /what you plan to do with their data. The issue of consent i.e. your customers choosing to withdraw consent and your business complying fully with those requests should be now be treated very seriously, and there must be consistency with what your company says it is going to do and what actually happens.

Sadly, it appears that all too often, large organisations / companies don’t appear to be handling our data in a way that we would like or have requested. For example, Facebook’s sharing of the personal data of 87 million users with Cambridge Analytica caused widespread outrage, and recently the ‘Deceived By Design’ report by the Norwegian government-funded Consumer Council has accused tech giants Microsoft, Facebook and Google of being unethical by leading users into selecting settings that do not benefit their privacy.

It may be that we have to wait a little longer and see a few more big tech companies being properly held to account before things start to really change for the better for users.

Trustwave’s SpiderLabs has created a new penetration testing tool that uses facial recognition to trace your face through all your social media profiles, link your name to it, and identify which organisation you work for.

Why?

According to its (ethical) creators, Trustwave’s SpiderLabs, Social Mapper has been designed to help penetration testers (those tasked with conducting simulated attacks on a computer systems to aid security) and red teamers (ethical hackers) to save time and expand target lists in the intelligence gathering phase of creating the social media phishing scenarios that are ultimately used to test an organisation’s cyber defences.

What Does It Do?

Social Mapper is an open source intelligence tool that employs facial recognition to correlate social media profiles across a number of different sites on a large scale. The software automates the process of searching the most popular social media sites for names and pictures of individuals in order to accurately detect and group a person’s presence. The results are then compiled in a report that can be quickly viewed and understood by a human operator.

How Does It Work?

Social Mapper works in 3 phases. Firstly, it is provided with names and pictures of people. e.g. via links in a csv file, images in a folder or via people registered to a company on LinkedIn.

Secondly, in a time-consuming phase, it uses a Firefox browser to log in to social media sites and search for its targets by name. When it finds the top results, it downloads profile pictures and uses facial recognition checks to try and find a match. The social media sites it searches are LinkedIn, Facebook, Twitter, Google+, Instagram, VKontakte, Weibo, and Douban.

Finally, it generates a report of the results.

What’s The Report Used For?

The report is designed to give the user a starting point to target individuals on social media for phishing, link-sharing, and password-snooping attacks.

For example, a user can create fake social media profiles to ‘friend’ targets and send them links to credential capturing landing pages or downloadable malware, trick users into disclosing their emails and phone numbers e.g. using vouchers and offers to tempt them into phishing traps, create custom phishing campaigns for each social media site, or even to physically look at photos of employees to find access card badges or to study aspects of building interiors.

What Does This Mean For Your Business?

In the right hands, Social Mapper sounds as though it could ultimately help businesses to improve their online security because it helps to create much better quality and more realistic testing scenarios on a larger scale that could uncover loopholes and shortcomings that current testing may not be able to fund.

The worry, however, is that in the wrong hands it could be used by cyber-criminals to quickly gather information about a target business and its employees, thereby enabling potentially very effective phishing and password-snooping campaigns to be created. This detailed information could also be shared among and sold to other criminals which could mean that individuals could be subjected to a number of attacks over time through multiple channels.

The obvious hope is, therefore, that enough checks and security measures will be put in place by its creators thereby not allowing the software to fall into the wrong hands in the first place and be used by criminals against the businesses and organisations that it was designed to help.

It has been reported that Microsoft is to launch InPrivate Desktop for a future version of Windows 10, a kind of throwaway sandbox that gives Admins a secure way to operate one-time tests of any untrusted apps / software.

Like A Virtual Machine

Although the new feature is still a bit hush-hush, and has actually been removed from the Windows 10 Insider programme, it is believed to act like a kind of in-box, speedy VM (virtual machine) that is then refreshed to use again after it has been used on a particular App.

Why?

The reason for the new feature in the broader sense , is that it fits with moves announced by Microsoft last June 2017 to introduce next-generation security features to Windows 10.

ATP & WDAG

Back in June 2017, Microsoft specifically mentioned the integration of Windows Defender Advanced Threat Protection (ATP) as one of the next-generation security measures. ATP, for example, was designed to isolate and contain the threat if a user on a corporate network accidentally downloaded malicious software via their browser.

A security feature that some commentators have likened InPrivate Desktop to, that was also specifically mentioned last June, was Windows Defender Application Guard (WDAG). Interestingly, WDAG isolates potential malware and exploits downloaded via a users’ browser and contains the threat using virtualisation-based security.

Spec Needed For InPrivate Desktop

Although the exact details of InPrivate Desktop are sketchy, we know that it is likely to be aimed at enterprises rather than individual users and that, as such, it is likely to need a reasonable spec to operate. It has been reported that in order to run the new feature / app at least 4GB of RAM, at least 5GB of free disk space, and two CPU cores will be needed.

When?

There is also still some speculation as to exactly when the InPrivate Desktop feature will make it to Windows 10. Some commentators have noted that it may not make it into Windows 10 ‘Redstone 5’, and looks likely to be rolled-out in a subsequent Windows 10 update which has been codenamed 19H1.

What Does This Mean For Your Business?

With support stopping for previous versions of Windows, and with all of us being forced into using Windows 10’s SaaS model, it makes sense that Microsoft adds more features to protect users, particularly businesses.

Adding malicious code to apps has been a method increasingly used by cyber-criminals to sneak under the radar, and having a secure space to test and isolate dubious / suspect apps will give Admins an extra tool to protect their organisation from evolving cyber-threats. It is extra-convenient that the testing feature / app sandbox will already be built-in to Windows 10.

IBM has announced that it has created its own stealth, ultra-evasive AI malware called ‘DeepLocker’ that can evade all traditional cyber-security protection, hide in normal applications, and only strike when it is sure it has reached its intended target.

Why?

Cyber-criminals are becoming ever-more sophisticated in their methods, and the resources available to them have increased e.g. as hackers have also worked in state-sponsored activities. Also, the world of Artificial Intelligence (AI) has come along leaps and bounds in recent years, and the fear is that cyber criminals could soon be deploying their own AI-powered malware. IBM has, therefore decided to create its own version in order to see how it works and behaves, and thereby gain valuable information which could help it to reduce risks, and find ways counter such attacks.

DeepLocker

One of the things that makes DeepLocker so different to other malware that tends to take a scattergun approach to infection is that it can hide itself and its intent until it reaches a specific target.

This is down to DeepLocker using deep neural network (DNN) AI model, a sophisticated computer system modelled on the human brain and nervous system. This DNN provides a kind of ‘black box’ that totally conceals the “trigger conditions”, and makes attack almost impossible to decipher and reverse engineer. DeepLocker’s AI can, therefore, even convert its own concealed trigger condition (which has been transformed into a deep convolutional network), into a “password” or “key” to unlock its own attack payload when it identifies its victim. In this sense, it contains three layers of attack concealment.

Hides & Identifies

According to IBM, DeepLocker can hide itself completely in normal ‘carrier’ applications such as video conference software. This enables it to fly completely under the radar and avoid detection by most antivirus and malware scanners. It also allows it to be spread widely and without providing any clues that there is a threat.

What Does This Mean For Your Business?

Malware attacks have cost businesses, organisations and whole economies vast amounts of money and untold disruption and problems in recent times. Evasive malware has been evolving for many years now as cyber-criminals try to find their way around better security measures and more sophisticated sandboxes. AI attacks using ultra-evasive, stealth methods of the nature of DeepLocker represent the next frightening wave of attack that organisations and businesses will have to face. It is a good thing, therefore, that IBM has tried to take the initiative and gain a march on cybe- criminals who will undoubtedly seek to weaponise AI, by creating its own version in order to learn lessons in advance that could provide at least some level of protection and recommendations for counter-measures.

The latest Office for National Statistics’ annual Internet Access and Use report has revealed that there has been a big rise in the number of people using commercial video streaming services.

Video Streaming Popular

The report shows a big jump from 29% of those watching online video-on-demand from commercial services in 2016 to 46% in 2018. The figures for 2018 refer to data collected in the January, February and April 2018 modules of the Opinions and Lifestyle Survey (OPN) conducted by the ONS.

The popular video-on-demand services referred to in the report include Netflix, Now TV, and Amazon Prime.

More Subscriptions To Online Video Steaming Than ‘Traditional’ TV

This supports Ofcom’s recent Media Nations report, which has replaced the PSB Annual Report and Digital Radio Report (and is based on BARB Establishment Survey data.), which shows that more people now subscribe to Netflix, Amazon and NOW TV than there to ‘traditional’ pay-TV services e.g. Sky, BT and Virgin.

The report showed that pay-TV subscriptions in the UK totalled 15.1 million, while the leading three on-demand video services totalled 15.4 million.

The Ofcom data showed that 39% of UK households (11.1m) have at least one on-demand streaming service subscription, and although Amazon Prime Video has a slightly larger year-on-year growth rate than Netflix, Netflix is the most popular subscription video-on-demand service, with subscriptions nearly doubling that of its closest rival – 9.1 million UK households Q1 2018.

Why?

The huge growth of popular video-on-demand services is the result of a number of factors including the fact that more than 80% of UK homes have a fixed broadband connection (90% of UK homes have some kind internet access), and 58% of these connections are considered to be superfast (30Mbit/s or higher download speeds), and that there has been a big rise in the number of people owning / using smart TVs and streaming dongles / boxes.

YouTube Popular Too

Google’s video social network platform YouTube has also seen a big rise in the number of people using the service – 62% in 2018, up from 47%.

Older People Using The Services

It appears that another reason for the rise in popularity of on-demand video-streaming services is that older people are now signing up. This is reflected, for example, in the fact that services such as Netflix are commissioning original shows pitched at more mature audiences.

What Does This Mean For Your Business?

Products / services that can be distributed via the Internet e.g. films and TV shows have almost inevitably increased in popularity at a time when most households have a broadband connection and when most people have a smartphone.

As consumers who are used to more choice and the ability to access more personalised offerings and experiences from businesses in a growing subscription economy, and who may have become used to ‘traditional’ pay-TV services, it is just a short jump to the greater choice and convenience of on-demand video services such as Netflix and Amazon. Just as more older people are populating social media platforms such as Facebook, older audiences are also now more used to technology and are finding it easier and beneficial to switch to video-on-demand from commercial services.

This increase in the popularity of such services means that the market for them is set to become more crowded (which is often good news for the consumer) as other players try to take advantage of the consumer viewing trends. For example, Sky is reported to be about to make all its content available online; Apple is expected to launch a TV subscription service soon;, and Disney may also soon be expanding the content available via its DisneyLife app.

If you want to be able to quickly edit the metadata of any files in Windows 10 (e.g. set when photos were taken), and add tags and categories to files, it can be done in 2 easy steps. Here’s how:

– In File Explorer, use the Shift+Alt+P to bring up the details pane. This shows details such as picture dimensions and the date a file was created.

– Click on any of the file fields and edit the metadata as required.

The latest figures from Apple appear to show that it has beaten tech giants like Amazon in the race to become the world’s first trillion dollar company.

‘Alarmingly Healthy’ Finances

It has been reported that Apple’s finance chief, Luca Maestri has described Apple’s current financial state as being “alarmingly healthy” after a net profit of a staggering $48.5 billion in was made in 2017, with $285 billion of cash reserves.

Reaching The Trillion Mark

The Trillion dollar valuation was reached thanks to a jump in Apple’s share price last Thursday that was driven by quarterly financial results that were better than Wall Street had expected for the US company that was founded back in 1976.

The Figures

Record sales of $53.3bn, coupled with $11.5bn profits in 3 months boosted confidence and share value in the tech behemoth to the point where the value of Apple jumped from $935bn to $1tn.

To give some context to this figure, Apple’s $1tn market value is larger than the economies of Turkey and Switzerland, and more than a third the size of the UK economy!

Great Products

Apple’s 42 year rise to mega-value has been fuelled by some great, highly differentiated, popular, and profitable products such as the Macintosh, the iPod and the iPhone – although the iPhone hasn’t always met sales expectations.

Not PetroChina Then?

No. Contrary to reports that energy company PetroChina hit the magic $1tn valuation back in 2007, it has since been revealed that only 2% of the company was released for public trading, and the resulting value claim is, therefore, widely regarded as being unreliable.

Delighted…Understandably

Apple’s CEO, Tim Cook, is reported as expressing his delight at the news of the record-breaking value of the company, and attributed the recent good financial results to strong sales of the iPhone, as well as Services and Wearables.

What Does This Mean For Your Company?

While it’s interesting (and perhaps not unexpected) and inspirational to hear of the incredible financial milestone that Apple has reached, and its true that Apple sometimes has a fan-like following for its innovative, differentiated, and aesthetically pleasing personal gadgets, the wealth of another tech giant is a world away from the daily business reality that many face in the UK, particularly with the uncertainty of Brexit on the horizon.

Some critics may also say that its relatively small tax contributions in some overseas markets e.g. Ireland (where it was ordered to pay €13bn in back taxes) have contributed to its profitability. Also, another blot on Apple’s copy-book in the name of cost-cutting has been the revelations over poor working conditions in Chinese factories where Apple iPhones are manufactured dating back as far as 2009.

Amazon has been seen by many commentators as being locked in battle with Apple to reach the $1tn mark, and will no doubt be disappointed at missing-out on being the first to cross this lucrative finishing line.

The latest figures show that even though Amazon’s profits trebled last year, their UK tax bill has significantly reduced.

How Much?

Amazon’s reported pre-tax profits have jumped from £24.3m to £72.3m with the company making £1.98bn in sales revenue. Where their tax bill and contributions are concerned however, the bill is down from £7.4m a year ago to just £4.6m, and their warehouse “fulfilment centres” division (Amazon UK Services) has been able to defer £2.9m, meaning that £1.7m in tax is the contribution being paid for now.

Also, Amazon Web Services UK has paid £155,000, down from £404,000 last year, even though profits there have nearly doubled from £2.7m to £5m.

Why?

Share-based payments for staff is the main reason offered by Amazon for its low tax bill during a profits boom. For example, Amazon employs more than two-thirds of its 27,000-strong UK workforce, and it has been reported that full-time warehouse staff have, on average, received shares worth more than £1,000 a year. AWS is reported to have given its staff share awards worth £11.8m (compared to shares worth £5.8m two years ago).

A rising Amazon share price has resulted in the selling of many of these shares on the open stock market. Since the tax bill is based on the sale price for company and individual, this has contributed to a lower tax bill.

Some commentators have also pointed out that Amazon basing its European operations in Luxembourg has also offered some significant tax-haven opportunities.

Based On Profits Not Revenues

Despite some anger in the UK over what looks like a relatively small tax liability for a company that appears to be doing so well here, Amazon has reportedly defended itself by saying that tax is based on profits, not revenues, and profits have remained low due to a competitive retail market, Amazon’s low-margin business, and its continued heavy investment.

Reform Calls – Public Contracts

Some commentators have also been critical and called for reform over Amazon’s payments for public contracts. For example, it has been reported that Amazon was paid more for online storage services by the Government over the first 3 months of this year than its biggest UK arm was taxed last year, despite Amazon not being made to reveal the details of their tax arrangements.

What Does This Mean For Your Business?

It is a source of great annoyance to many UK businesses that receive and pay significant tax bills, that an overseas tech giant company can appear to make big profits in the UK and yet only be required to pay what appears to be a relatively small amount of tax. It has echoes of Facebook’s UK operations last year paying only £5.1m in corporation tax, despite a profits jump and a quadrupling of revenue, thanks to advertising sales.

Whilst some are calling for reform, and some anger has been publicly expressed, some commentators have pointed to a fear of losing big companies this close to Brexit as a reason why we may not expect HM government to come down too hard on Amazon and other tech giants for the time being.

The European Commission anti-competition ruling against Google that will force it to change its OS by unbundling the Google Play store and native apps could help other phone makers, but could also make the new ‘P’ version of Android’s OS less interesting.

90 Days To Change

The EC ruling, which also imposed an eye-watering $5 billion fine this month, essentially means that Google only has a 90 day period in which to unbundle popular parts of its Android OS so that it no longer receives what the EC sees as an unfair advantage over competitors.

Manufacturers Forced To Bundle

For example, up until now, purchasers of Android phones from any manufacturer have had Google Play store to install its apps by default on their new phone. This is because Google has only enabled phone makers to access the Play store (which is needed for downloading popular apps) if they agreed to use a version of Android that preloads 11 bundled Google apps onto their smartphones.

No Choice

Also, even though phone manufacturers have been able to use Android Open Source Project Android software, this doesn’t have the Google APIs that are needed to link major apps to the Play store. Phone manufacturers have, therefore, been left with no choice but to agree to bundle Google’s native Android apps if they want their customers to have a good experience with their phones.

Real Opportunities For Competitors Now?

It is tempting to think that the ruling will now create many real opportunities for other, smaller phone manufacturers as they can customise the open source architecture and bypass native Google apps.

Some commentators have, however, pointed out that Google’s huge investment over the last decade in pre-loading Android with its most popular apps, and thereby making an Android phone work straight out of the box, is of value to consumers. The likelihood is, therefore, that customers would actually prefer to have the bundled Google apps anyway because they are used the convenience that they offer. This means that the EC’s judgement may have been several years late anyway, manufacturers will continue to need to offer Google services to be competitive and address consumer demand, and the ruling may not be offering any real extra opportunities for competing phone manufacturers in the near future.

The New Android P

The new Android 9.0 P / ‘Pie’ OS is beginning its rollout, firstly for Pixel devices and Essential Phone, and for Android One users later in the year, with all third-party handsets that participated in the Android P beta (Sony Xperia XZ2, Xiaomi Mi Mix 2S, Nokia 7 Plus, Oppo R15 Pro, Vivo X21 and OnePlus 6), receiving the update in the autumn.

The new OS has AI built-in, and there’s a strong focus on a smarter, simpler experience that is tailored to individual user patterns and offers adaptive features e.g. Adaptive Battery and Adaptive Brightness. In order to comply with the EC’s ruling, however, there is speculation that the new official Android OS will simply be released without the Google default apps, but consumers will simply seek them out and install them anyway.
Bad For Consumers?

Some critics of the EC ruling have also pointed out the possibility of some bad unintended consequences for consumers such as greater app inconsistency, and increases in hardware costs.

Google Games Woes

It appears that Google will also be missing out on a slice of the games world profits through Google Play. It has been reported that Epic Games, the makers of the popular multiplayer game Fortnite, will be bypassing Google Play and offer the game directly to hitherto overlooked Android, because it’s unhappy with the 30% slice of the profits Google would take through Google Play. Instead, Fortnite for Android will be made available directly on the Epic website, thereby cutting out the Google middle-man.

What Does This Mean For Your Business?

The idea of a fair playing field is obviously attractive to businesses, particularly smaller businesses that may also be later into a market. Clearly, the EC ruling shows that things do appear to have been stacked in Google’s favour in the Android market for some time, but many would argue that the ruling has come too late, and that consumers may now not actually benefit from the decision. It is, however important that powerful tech giants have to answer to some authority greater than their own in the interests of choice and fair competition.

Google has appealed, and it remains to be seen how the EC decision and what changes Google makes will affect the Android OS and the dynamics of the marketplace.

Google has announced that it will be adding a feature to G Suite that will let businesses / organisations know if their users are being targeted by a government-backed cyber attack.

What Is G Suite?

G Suite is the package of cloud-based services designed to aid collaborative working, formerly known as Google Apps for Work. It was introduced in 2006, and has since been expanded to include apps like Gmail, Hangouts, Calendar, Google+; Drive, Docs, Sheets, Slides, Forms, and the digital interactive whiteboard Jamboard.

The New Alert Feature

The new feature, which will be added to the Admin console, will mean that Admins can choose to receive an email alert when Google detects a state-sponsored / government-backed attack attempt on a user’s account or computer e.g. via phishing, malware, or any other known method.

The alert feature will be turned off by default, but Admins can choose to turn the alerts on via Admin Console > Reports > Manage Alerts > Government backed attack.

If Admins choose to turn the feature on and make the alerts the default, they can decide who gets notified when attacks are suspected. In the first instance, alerts will be sent by email to Super Admins, but this can be changed to share the information with others via the same Console link.

Also, the feature allows Admins to choose what actions they want to take to secure an account on receiving the alert, and Admins can let the user know about the alert and any actions they have taken.

The launch of the new feature will go to both Rapid Release and Scheduled Release, will be available to all G Suite editions, and will be introduced in a gradual rollout (up to 15 days for feature visibility).

Warnings Since 2012

Even though this is a newly designed feature, Google has been warning users of any suspected targeting of their accounts by government-backed attackers since 2012.

Why The New Feature?

Google has introduced this feature for a number of reasons, the main one being that high-level nation-state cyber threats have become much more of a problem for organisations in recent times, either directly or indirectly through cyber-crime groups acting as state proxies.

GCHQ, for example, has reported seeing a crossover between nation states and criminal groups acting on their behalf, often with the same people working on nation-state cyber activities by day and criminal activities by night.

Also, Google wants to increase business confidence in its cloud-based services, and protect its business users from hacking.

Another influence that has prompted the introduction of the new feature is that competitors are offering something similar e.g. Microsoft’s new AccountGuard pilot program (currently only available for accounts from political organisations), introduced as part of its ‘Election Defence Technologies’ and offered by invitation only.

Being able to announce some good news about its security / privacy services for business clients has also been helpful at a time when Google has been criticised by The US Department of Homeland Security for potential problems with Gmail’s new confidentiality mode.

What Does This Mean For Your Business?

This crossover between nation states and criminal groups acting on their behalf has blurred the threat lines in the world of online security and necessitated the addition of this kind of feature. The fact that it has been designed to protect and reassure business users is clearly good news for G Suite users everywhere.

State-sponsored cyber attacks can cause huge damage and disruption to businesses that are directly or indirectly hit, and this can also have a negative knock-on effect on the wider economy too. It is good news, therefore, that businesses / organisations can now receive and manage alerts about potentially serious attacks, and this will add another layer of defence in an environment of evolving worldwide threats.