Insights For Success

Strategy, Innovation, Leadership and Security

Calgary airport offers the best WIFI performance in Canada

GeneralEdward KiledjianComment
skyline-calgary-866032.jpg

Ookla, everyone's favourite speed test service has just published internet performance metrics for North American airports. Calgary Airport has been rated as the best performer of all Canadian airports and is the third best in North America.

  1. Seattle Tacoma International
  2. Denver International Airport
  3. Calgary International

Montreal's Pierre Elliot Trudeau Airport was rated the worst. Toronto's expensive Toronto Pearson International Airport is rated 23rd.

Examples of Darknet (TOR) sites

GeneralEdward KiledjianComment

I have received a lot of requests from readers, LinkedIn and Twitter connections to provide examples of some "interesting" darknet (TOR Onion Network) sites. I have posted over a dozen on my LinkedIn page but thought I would show a couple here.

My security team and I perform internet and darknet reconnaissance work to create briefing packages on cyber crime, determine trends and spot organizational dangers. As part of this research, we sometimes stumble on interesting examples that I share. 

I have chosen not to hide the onion addresses (aka the URL) because I want to show that these are not made up designs but actual sites. I discourage anyone from using or visiting these sites. I am providing these as example for educational purposes only.

2.PNG

Bitcoin Fig is a centralized Bitcoin tumbler. A Cryptocurrency tumbler is a service that intakes identifiable, tainted or stollen cryptocurrencies and delivers them back with an obscure trail. This is used to improve anonymity when questionable transactions are being performed. These firms typically charge 1-4% of the "cleaned" amount and operate out of countries with strict private banking laws like Cayman Islands, Panama and the Bahamas.

3.PNG

The The Cannabis Growers and Merchants Cooperative CGMC is a "by invitation" cannabis market. They offer a trustless (aka escrow) shopping experience to protect buyers.

4.PNG

The sense of anonymity offered by TOR, attracts many with much more questionable products. Above is the French connection that deals in Heroin, Meth, brown sugar, Superman XTC pills, black tar, Amber glass BHO crumble and other products guaranteed to screw your life.

5.PNG

We've covered drugs and now we turn our attention to sports betting. BETTOR claims to be a marketplace that sells winning bets (not predictions). They claim to have 100% winning bets for football, basketball and tennis. I don't gamble so I cannot vouch for the quality of their recommendations. 

6.PNG

CyberGuerrilla is another example of groups using the pseudo-anonymity of TOR to do what they probably wouldn't on the "normal" internet. This site describes it's mission as "The CyberGuerrilla Collective is an autonomous body based in Europe with collective members worldwide. Our purpose is to aid in the creation of a free society, a world with freedom from want and freedom of expression, a world without oppression or hierarchy, where power is shared equally. We do this by providing communication and computer resources to allies engaged in struggles against capitalism and other forms of oppression."

I describe this site as a blog platform for closet anarchists. 

7.PNG

Escrow defense is a buyer/seller escrow service. 

8.PNG

Cash is King is a get rich quick scheme. You pay them in BItcoin and they "sell" you cash that was destined for destruction. They claim to have a way of moving the cash before it is destroyed but need you to "launder it". How much is this service you ask?

9.PNG

What if you were scared as a king by Burger King and want nothing to do with a King? What is a cash strapped person to do? You can always buy counterfit US dollars from the USD site

11.PNG

What if you want to deal with digital currency? No worries, enter Vendor. Vendor sells hacked Paypal accounts.

12.PNG

How do you cash out these PayPal accounts without getting caught? Conveniently they offer a "cheap" laundered bitcoin service for a small nominal fee ($45USD for each BTC).

13.PNG

So now you have your drugs, your cheap cash and your cheap bitcoin. All this money is burning a hole in your wallet and you want to spend it on "cool" stuff. How about some counterfeit clothing?

18.PNG

What about stolen electronics like a Sony Playstation, an iPad, iPhone, Acer laptop,  or Samsung Galaxy S9?

 

14.PNG

Since you haven't spent all your money yet, maybe you should think about the future and use DoubleBit to grow your crypto using darknet markets. For a "small" fee, they will "invest" your crypto for growth then will return "clean crypto" back to you with outrageously generous short term returns (I am being sarcastic, I have never used their service so I wouldn't know).

Why invest when you simply buy money from the BigDeal marketplace (http://bh3ly32vcg52brrc.onion/)

15.PNG
16.PNG
17.PNG

If you work for a publicly traded company and want to cash out some insider knowledge, you can use The Stock Insiders site

19.PNG

Snapchat usage grows amongst teens

GeneralEdward KiledjianComment
twitter-292994.jpg

Pew Research publishes interesting surveys, and they recently shared results about what teens use most. Contrary to public opinion, Snapchat is still king with teens, followed by Youtube. Facebook usage amongst teens is down 71% compared to the 2014-2015 Pew report. 

  • 45% of teens admitted to being online "almost constantly."
  • 24% of teens admitted to being online "several times a day."

Girls are more likely to be "almost constantly" online (50%) compared to boys (39%). 

 Provided by Pew Research

Provided by Pew Research

Instagram is still going strong and 72% of teens now use it (up from 52% in 2015). 70% of teens use Snapchat (up from 41% in 2015). 

Most platforms have an equal amount of creation and consumption except Youtube, where the most significant proportion is consumption. 

You will notice that Snapchat and Instagram have higher usage than Facebook. Interestingly you will note:

  • Instagram/Snapchat are designed to post pictures, whereas Facebook supports photos but videos, links, text updates, etc.
  • Instagram/Snapchat are designed to be used on a smartphone, whereas Facebook is multiplatform. This is confirmed when the stats show that 95% of teens have or have access to a smartphone (88% of teens have access to a computer at home).

31% of teens believe social media has a positive impact on their lives while 24% think it has a negative one. 45% believe it has a neutral effect on their lives. 

Don't buy the Hooke Verse 3D Audio Bluetooth Headphone (Review)

GeneralEdward KiledjianComment
Hooke-Verse.jpg

I test thousands of products every year and can't remember the last time I recommended a clear DO NOT BUY!

The promise of these headphones (similar to the Sennheiser Ambeo headset) is that they will record  3D audio at a much higher fidelity. 

Whereas the Sennheiser is lightning based, which limits it to IOS products, the Hooke Verse is Bluetooth (which gives it more versatility). However, the Sennheiser Ambeo works with all platform video recording apps, while the Hooke Verse requires you to use their own proprietary app (because they need support for proprietary audio recording codecs). Here is where the problems start.

Problems with the Hooke Verse Software

I tested the product with a Samsung Galaxy S9+, a Note 8 and a Google Pixel 2XL. The Hooke Verse Android app is limited to 720p recording (even though all the devices support 4K at 30fps or more). Support confirmed that this is an application issue and that it will eventually be fixed.

The Hooke Verse Android app does not support the telephoto lens (on devices that have a physical telephoto camera).

Capture1.PNG

The interface is not intuitive at all and it is clear the required development planning wasn't done. The Video icon you see on the lower left-hand side isn't to record video but rather to turn off video recording and only capture audio.  To record you are expected to click on the 3D button.

The sliders on the sides are to adjust the gain but with a couple of lines of code, this could have been automated with the option of a manual override. The person buying this accessory wants to be as plug and play as possible.

Once you manage to record a video, you expect to see a rich share sheet to apps installed on your smartphone (Instagram, Snapchat, Google Photos, Twitter, Vimeo, etc), but you will only see 3 options:

Capture2.PNG

There isn't even an option to save to the camera roll (aka standard video folder in the device). 

Once you record and playback (in the app) your first video, they explain the additional audio filters you can buy for $4.99. Considering the price of these headphone's the filters should have been included for free (my opinion). Even if you buy the filters, there is no way to choose which one to apply since the filter controls are loaded beneath the media control buttons. Support said this would be fixed, but again, no ETA.

 If you look closely, you will see a bunch of circular filter choices under the media control buttons. There is no way to bring them to the forefront.

If you look closely, you will see a bunch of circular filter choices under the media control buttons. There is no way to bring them to the forefront.

Even the cheapest (and most free) video recording apps on the Google Play store support these functions (but the Hooke Verse Android app does not):

  • Histogram to determine exposure
  • Ability to lock exposure
  • Ability to lock focus
  • A guide for thirds on screen
  • Different recording qualities from the native format up to 100MB/s high quality (which most high-quality video recording apps support)

Problem with the Hooke Verse hardware

I recorded a video in an area with an overhead HVAC vent using the Sennheiser Ambeo (on an iPhone 7) and the Hooke Verse on a Pixel 2 XL. The Sennheiser successfully removed the background "air noise" while the Hooke Verse picked it up.

Conclusion

I contacted support (on memorial day) and someone responded which was nice, but they could not provide any ETA for app upgrades to fix these issues. At $249, consumers can rightfully expect a much more refined experience. 

There is no way I can recommend this product with all its glaring flaws My hope (and recommendation to the company) is to build their codec into FimicPro and make that the default app they provide with their headsets. I do not believe Hooke Verse will be able to build a "good enough" video app.

The out of the box experience was so bad in the first 24 hours that I am returning the headphone's back to Amazon. If you are on IOS, go for the Sennheiser Ambeo. If you are on Android (like me), you are out of luck. 

Chromebooks are great and here are some myths you might believe

GeneralEdward KiledjianComment
unnamed.png

Anytime I pull out a Chromebook in a professional setting, colleagues and friends are dumbfounded how a tech geek like me would "settle" for a browser only thin client. People are downright shocked when I pull out my $1200 Pixelbook. 

Why would I buy a "browser only" device when I could use a Windows or Mac device that can run the Chrome browser but do so much more?

Chromebooks can't run apps

If you are reading this article, there is a good chance you are not a millennial that grew up with iPads and smartphones. For you, a personal computing device (Windows, Mac or Linux) needs to run native apps. I'm here to shock you but Chromebooks (ChromeOS) devices do and do it without requiring dual-booting.

Chromebooks run Android apps. Most modern Chromebooks can easily install and run most Google Play store Android apps. The list of Android app capable devices is extensive and growing daily (list).

The most common Microsoft Office apps for Android (Word, Excel and Powerpoint) run surprisingly well on Chromebooks. 

Chromebooks will run Linux apps. VentureBeat first reported this and it was later confirmed during Google IO 2018. Goole's Chromebooks will be able to run native Linux applications using the built-in container technology (without dual-booting or emulation). 

Chromebooks will run Windows apps. CrossOver has a Chromebook app that will allow users to run Windows-only apps (like Quicken and Microsoft Office) on a Chromebook without needing to install Windows. 

Truth is that most users, will not need any of these functionalities most of the time. With a little updating of your work structures, you will likely be able to work on a Chromebook 98% of the time without needing to run Windows or Linux apps, but it's nice to know you can.

As an example, I switched to Polarr for my photo editing and it does everything I need. It is affordable, cross-platform and worth like a charm on Chromebooks. If you are looking for a very good password manager, you can use the Steve Gibson approved LastPass

Chromebooks are slow

You get what you pay for. When you compare dollar for dollar a Chromebook will always be fast, more reliable and more secure than Windows, Mac or Linux. The comparison most people late is a $1000 Macbook to a $250 Chromebook. That simply isn't a fair comparison. Chromebooks have become the defacto educational devices because they are very functional even at the low end of the scale. 

When comparing machines with comparable pricing, the Chromebook will always be faster.

I bought a $350 Acer C720P in 2013 (5+ years old) and it :

  • is still fast when running Chrome
  • receives regular updates from Google
  • is always kept secure by Google

I have 3+-year-old ($600-1000) Dell, HP and Lenovo Windows machines that have become slow and painful to use. 

My Pixelbook goes from powered off (not sleep but totally off) to ready to log in, in 5 seconds. 

Chromebooks are useless without an internet connection

I am convinced much of what you do (on your PC, smartphone or tablet) is internet based. As an experiment, try turning off WIFI (or cellular connectivity) for 1 day and see how dependent you really are. 

CR48.jpg

When the CR-48 came out (first Chromebook test unit from Google), it was nothing more than an internet connected thin client. This hasn't been true for a long time though. 

Google's most popular services (Gmail, Calendar, Google Drive, Google Docs, Google Sheets, etc) are all offline enabled. The Google Chrome Web Store even has a page dedicated to offline apps.

offline.PNG

Add to these the millions of Android apps and you can do just about anything offline these days. The Chromebook actually has an advantage over competing platforms here (Windows or Mac). As an example, on a traditional laptop, I can't download Netflix content for offline consumption whereas I can with the Android Netflix app running on a Chromebook. Since Chromebooks are power efficient, this becomes an excellent offline and disconnected media consumption platform (aka planes).

Chromebooks barely run Android apps

For better or worse, Google makes many of its experiments public. It is true that Google has made multiple attempts to bring Android to Chromebooks (ChromeOS) and that most have failed. If you tried running Android apps on a Chromebook even a year ago, you may have thought it was a slow and painful experience but not anymore. It still isn't perfect but for those unique occasional needs, the current setup more than satisfies that functionality itch. 

I have tested Android apps on a Google Pixelbook, Acer Chromebook Flip C302 and a Samsung Chromebook Pro and the apps worked great on all of them. 

Chromebooks have no local storage

Not sure how this started but all Chromebooks have local storage. My Pixelbook comes with 250GB of lightning-fast SSD storage (similar storage capacity to my  MacBook Pro Retina). For content that is only occasionally accessed, you can store it in the Google Drive cloud and access it as you would a local file. The Chromebook "file explorer" integrated Google Drive for easy access. 

Chromebooks can't print

Chromebooks support both local and network-based printers. For most users, you will plug in your local printer via USB and it will automagically work (if it is a recent printer). When shopping for a new device, why not opt for one that is Google Cloud Print ready? All major manufacturers support Google Cloud Print, including but not limited to : Brother, Canon, Dell, Epson, HP, Kyocera, Lexmark, Sharp, Toshiba, Xerox and more.

Chromebooks don't have any antivirus protection

This comment comes from Windows users that have been trained to install antivirus products on all of their devices. 

Remember that ChromeOS (the operating system powering Chromebooks) was designed to be secure from the start. As an example, it uses techniques like process isolation to keep you safe. Most manufacturers say that Chromebooks do not need antivirus products because : 

  • ChromeOS is updated every 6 weeks
  • ChromeOS is designed with an application and process sandboxing framwork
  • All data on a Chromebook is encrypted by default
 Sample support page from Toshiba

Sample support page from Toshiba

So let's extend the question and talk about Chromebook (ChromeOS) security. Why do most security professionals choose Chromebooks as their personal device of choice? Why do security professionals bring Chromebooks to the world's most tech hostile conferences (blackhat, defcon, shmoocon, etc)?

The answer is that Chromebooks are more secure than any other traditional computing platform (including MacOS). How?

  • Automatic updates - Google pushes a ChromeOS update every 6 weeks that all devices receive immediately (regardless of where you bought your Chromebook from and the manufacturer of the Chromebook). These updates add functionality but more importantly they fix security issues.
  • Sandboxing - Each web-page and application on a Chromebook is isolated from every other web-page and application using a technique called Sandboxing. If you visit a malicious web-page, the malware cannot infect other tabs or the computer itself. 
  • Verified Boot - If magically threat actors manage to exploit a vulnerability and "jump" out of the sandbox to infect the boot process (to ensure they infect the device every time it restarts, The verified boot process will detect this and it will automatically repair itself. Every time a Chromebook boots, it checks itself and if it detects that the boot process has been tampered with, it fixes itself without any user intervention. 
  • Data Encryption - Using tamper-resistant encryption (a local TPM chip), all local data is encrypted with a user key which means it cannot be accessed by other users or by threat actors if stolen.
  • Recovery Mode - If anything does go wrong with your Chromebook, you can use a special keyboard combination (differs by manufacturer to enter a special recovery mode that brings back a fresh, clean version of ChromeOS in minutes and with no user intervention. All your data and settings are stored in the cloud so as soon as you log in, your personalizations and settings will all automagically come back.

Conclusion


This article could have easily been 5 times longer, but I believe I captured the most important concepts. If you haven't tried a Chromebook in a while, I encourage you to take a look. Remember that no single device meets everyone's needs, and a Chromebook is no different. I believe Chromebooks are THE alternative for most general computing users and even some individual edge cases (like us crazy security people). 

Remeber that you get what you pay for. Don't expect a $200 Chromebook to perform like $1200 MacBook. Compare a $1200 Google Pixelbook to a $1200 MacBook, and now you have a fair comparison.