by Marc Mintz | May 11, 2018
Q: How do I know who’s monitoring my calls on iOS? I keep hearing beeping sounds in calls.
A: It is almost inconceivable that the sound you are hearing has any association with possible monitoring of your phone. The reasons is there isn’t any reason for a penetration device or process to introduce noice on the line.
The overwhelming probability is you are hearing normal line noise.
That said, calls are monitored or devices penetrated all the time by your phone company, the government, criminals, kids, and there is always that whackadoodle ex. Because there isn’t a good way to know if you or your device is a target, the solution is to use encryption tools.
I like both Signal or Wire for voice calls, and Wire for instant messaging. Both offer point to point military grade encryption – the gold standard. Once you start to use quality encryption tools, you can sleep a bit better at night.
by Marc Mintz | May 11, 2018
Q: MAC addresses are coming up on my network. How do I block them?
A: Every device that is able to access either ethernet or wi-fi has a unique MAC (Media Access Control) address. Although the MAC address is hard-coded into the network chip, it can be spoofed.
Any quality router will include the ability to turn on MAC Address Filtering. Once activated, enter the MAC addresses of your own devices as “allowed”, and then disallow any other MAC address from the network.
Now retrace your network security:
- Are your WiFi passwords strong?
- Have you changed your WiFi passwords recently?
- Are your network communications encrypted using WPA2 AES?
- Are your storage devices encrypted?
- Are there ethernet jacks that can be accessed by others without notice?
by Marc Mintz | May 11, 2018
Q: What are the limitations of an antivirus in protecting a PC?
A: First and foremost is an antivirus (anti-malware) is limited to protecting against only malware. Malware is just a minor player in the cybersecurity arena.
They are limited to protecting only against the malware they have been designed to recognize. Even the very best protect against perhaps 99.9% of known malware. Depending on whose numbers you believe, there may be more than 100,000,000 malware in the wild. That leaves at least 10,000 known malware even the very best don’t protect against.
As to how many unknown malware are in the wild? Nobody knows.
And then when they come up against malware they know about, they are limited in how well they eliminate the threat, and limited in saving any damaged data – or preventing data from being harvested.
A solution that works more reliably than antivirus is application whitelisting – specifying which applications may run. Then, should malicious code find its way into your device and attempt to run, it is automatically blocked as unauthorized.
Once the malware issue is dealt with, then you can turn your attention to the other security and privacy issues your device faces; email hacking, instant message hacking, phone call monitoring, man in the middle attacks (notice women rarely get in the middle of this) (sorry, it had to be said and I was just standing around), social media (it’s own kind of malware), storage device encryption, Multi-Factor Authentication, Disaster Recovery and Business Continuity Planning, etc.
by Marc Mintz | May 11, 2018
Q: What Wi-Fi system is recommended to cover 1,000 users per month.
A: It’s not so much the users/month, but the maximum number of concurrent users, and the bandwidth of your internet connection that are limiting factors. Your available budget is also a factor.
For example, let’s say your internet bandwidth is 100Mb/s. If you have 100 concurrent users, that is 100Mb/s divided by 100 users, or 1Mb/s/user. That is barely adequate to maintain a connection.
So the first challenge is to have adequate internet bandwidth, based on the maximum number of concurrent connections, and how much minimum bandwidth you wish to allocate per connection. A good number to start with is 5Mb/s. This will allow a stable connection and tolerable browsing speed.
The next challenge is the maximum number of users connected to an access point. Consumer-level access points can typically manage from 10-50 concurrent connections. At some point, they will refuse any additional connections. Professional/Enterprise-level devices will be able to manage up to 250 concurrent connections.
However, even if you purchase a high-end unit capable of 250 concurrent connections, if the access-point is capable of a maximum of 1,300Mb/s throughput, that is 1,300/250 or 5.2Mb/s per connection. And that 1,300Mb/s rate is only available when the connected device is within a few feet. As the distance between the access point and the connected device increases, the available connection speed drops quickly. At an average distance of 100′, the average connection speed may drop to 1Mb/s.
The solution used for large conference halls, sports stadiums, (even Apple Stores) is to have many access points spread around the area, all connected via ethernet to a centralized router, each using the same SSID (Wi-Fi network name), operating as a wired mesh network. Have an adequate number of access points so that none are ever pushed near 50% capacity.
As an example, An Apple Store may have 20-30 Wi-Fi channels running on high-end Cisco Access Points to cover just one store.
by Marc Mintz | May 11, 2018
Q: How can I stop other people from seeing what I’m doing on my tablet when using their WiFi?
A: The same easy answer to many cybersecurity questions – install and use a Virtual Private Network (VPN).
When using VPN all of your communications are encrypted between your device and the VPN server in the cloud. This makes it (almost) impossible for anyone (but the VPN host) to view your online activity.
There are thousands of VPN providers available. Many, if not most, or not ethical–particularly those that offer services for free. There are several dozen factors to consider when choosing a VPN provider, these are the ones I believe are most important:
- Operate in a country that supports cyber security, and is outside the reach of government intrusion.
- They keep no logs of your activities.
- They offer IKEv2 protocol (the most current, and perhaps most secure), or OpenVPN ( and open source protocol that has proven itself to be secure).
- Offers at least a one-day free trial to test if their product is fully compatible with your device.
- Is priced within your budget.
You will likely be paying between $30 and $80 per year for 2–6 devices that can connect to this one account.
Among my personal favorites are: NordVPN.com, Perfect-Privacy.com, and VPNarea.com
by Marc Mintz | May 11, 2018
Q: Is Hard Drive the best data archival option?
A: With few exceptions, acid-free paper is by far the best archival storage.
A few years back Ziff-Davis did a study on the archival options for IT. This was before solid state drives.
Pretty much everything (HD’s, floppy, cd, dvd) lasted less than 5 years before some corruption was found.
There is some consensus that today Hard Disk Drive (HDD) and Solid State Drive (SSD) last around the same as each other–five years before corruption sneaks in.
That said, there are new Blueray disc formats which promise 1000+ year archival quality.
Even if these devices lasted 10, 100, 1,000 years, good luck of then finding a computer and drive that will have the drivers and ports to read the device.
The best practices is to:
- Have 3 copies of your data. At least 1 copy on-site, at least 1 copy off site.
- Run diagnostics/repairs on storage device at least yearly.
- Copy data from a storage device to a fresh device at least every 5 years.
by Marc Mintz | May 11, 2018
Q: How can I recover my deleted documents on a Mac?
A: There are any number of data recovery utilities for macOS available for the consumer.
When an item is moved to the Trash, it is no different than moving it to another folder–as the Trash is just a folder.
When the Trash is emptied, default operation is that the data remains on the drive, but all of the pointers to the item located in the directory system are deleted. Data recovery involves recreating these directory pointers.
However, I don’t recommend end users attempting data recovery using these utilities. I’ve seen far too many times where the data which could have been recovered if the user had done nothing, become permanently deleted after they performed DIY attempts. One of my favorite phrases is just because you have a knife doesn’t make you a surgeon. It is easy to permanently erase data with these utilities.
Instead, if the data is important, I recommend finding a qualified data recovery service. An internet search will find them. MintzIT is one of them.
If the data is not important, sure, experiment with data recovery utilities.
Now, run out and buy an external drive for your local backups, and purchase an internet backup service as well.
by Marc Mintz | May 10, 2018
How does one get identified through Tor?
Tor is a web browser, that attempts to ensure anonymity by routing web traffic through a series of Tor nodes. Each node only knows which node it is receiving the packet from, and which it is delivering to. The nodes used change every few seconds. The overall internet system used by Tor is called the onion network.
There are several ways in which one gets identified even though using Tor.
The most important with regards to overall security and privacy is that if someone has access to entry and exit nodes, using a bit of intelligence, it is possible to start recognizing a pattern. Given that the US Government does own some entry and exit nodes, it only makes sense they are putting the pieces together.
The second most important method of being identified is through your browser fingerprint. Although you may think your computer is pretty much just like most others out there, there are indeed unique qualities about your computer that can identify it. Once identified, it can be tracked across the web.
The good news is that this part of the puzzle is easy to work around (although few do). That is to have a computer that is EXACTLY, PRECISELY stock. No added anything. Even better is to create a bootable Tails thumb drive (perform a web search on Tails). This is a bootable system with all the tools you need (browser, email, etc.) and since every user of Tails looks the same, makes you able to hide in plain sight.
by Marc Mintz | Apr 20, 2018
Practical Paranoia macOS 10.13 Security Essentials Update: Chapter 20 Social Media
As of April 21, 2018, The Practical Paranoia macOS 10.13 Security Essentials workbook has been substantially updated. Included is a rewrite of chapter 20 Social Media to reflect changes in Facebook and Google security.
The full chapter may be downloaded Practical Paranoia macOS 10.13 v2 20180421 Chapter 20 Social Media.
Owners of the Kindle book version may download the full book upgrade by:
- Delete the existing Practical Paranoia book from your Kindle device.
- Go to your Kindle library, and then download the Practical Paranoia book.
- The most current version will download.
Owners of the Live! book will automatically access the latest version the next time the book is opened.
by Marc Mintz | Apr 20, 2018
Practical Paranoia macOS 10.13 Security Essentials Update: Chapter 19 Internet Activity
As of April 21, 2018, The Practical Paranoia macOS 10.13 Security Essentials workbook has been substantially updated. Included is a rewrite of chapter 19 Internet Activity to reflect changes in Virtual Private Network (VPN).
The full chapter may be downloaded here: Practical Paranoia macOS 10.13 v2 20180421 Chapter 19 Internet Activity.
Owners of the Kindle book version may download the full book upgrade by:
- Delete the existing Practical Paranoia book from your Kindle device.
- Go to your Kindle library, and then download the Practical Paranoia book.
- The most current version will download.
Owners of the Live! book will automatically access the latest version the next time the book is opened.
by Marc Mintz | Apr 20, 2018
Practical Paranoia macOS 10.13 Security Essentials Update: Chapter 15 Email
As of April 21, 2018, The Practical Paranoia macOS 10.13 Security Essentials workbook has been substantially updated. Included is a rewrite of chapter 15 Email to reflect changes in email security.
The full chapter may be downloaded here: Practical Paranoia macOS 10.13 v2 20180421 Chapter 15 Email.
Owners of the Kindle book version may download the full book upgrade by:
- Delete the existing Practical Paranoia book from your Kindle device.
- Go to your Kindle library, and then download the Practical Paranoia book.
- The most current version will download.
Owners of the Live! book will automatically access the latest version the next time the book is opened.
by Marc Mintz | Apr 20, 2018
Practical Paranoia macOS 10.13 Security Essentials Update: Chapter 14 Web Browsing
As of April 21, 2018, The Practical Paranoia macOS 10.13 Security Essentials workbook has been substantially updated. Included is a rewrite of chapter 14 Web Browsing to reflect changes in browser security.
The full chapter may be downloaded here: Practical Paranoia macOS 10.13 v2 20180421 Chapter 14 Web Browsing.
Owners of the Kindle book version may download the full book upgrade by:
- Delete the existing Practical Paranoia book from your Kindle device.
- Go to your Kindle library, and then download the Practical Paranoia book.
- The most current version will download.
Owners of the Live! book will automatically access the latest version the next time the book is opened.
by Marc Mintz | Apr 20, 2018
Practical Paranoia macOS 10.13 Security Essentials Update: Chapter 4 Passwords
As of April 21, 2018, The Practical Paranoia macOS 10.13 Security Essentials workbook has been substantially updated. Included is a rewrite of chapter 4 Passwords to reflect changes in macOS 10.13.4 Keychain Access utility.
The full chapter may be downloaded here.
Owners of the Kindle book version may download the full book upgrade by:
- Delete the existing Practical Paranoia book from your Kindle device.
- Go to your Kindle library, and then download the Practical Paranoia book.
- The most current version will download.
Owners of the Live! book will automatically access the latest version the next time the book is opened.
by Marc Mintz | Mar 18, 2018
New Encryption Minimums by June 2018
Transport Layer Security (TLS) is a cryptographic protocol that provides secure communications over the Internet. The initial release of TLS has known vulnerabilities and is no longer considered secure.
To ensure the security and integrity of email, most email hosts and servers will be requiring upgrades to the current version TLS. Google (the 800-lb gorilla in the email world) is also pushing for full sender authentication records in the Domain Name Servers (DNS). There are 2 records which verify the sender and one that tells the receiver what to do with any emails that fail either of the first two tests. To ensure you and your organization’s email continues to be delivered after June 2018, the following changes must be made:
- Sender Policy Framework (SPF) is an email authentication protocol allowing the owner of a domain to specify which mail servers they use to send mail. The receiving email server will check the SPF record against the server actually sending the email. If the sending server isn’t listed in that SPF record, the message fails SPF authentication, and may be rejected.
- DomainKeys Identified Mail (DKIM) allows an organization to take responsibility for transmitting a message in a way that can be verified by mailbox providers. This verification is made possible through cryptographic authentication.
- Domain-based Message Authentication, Reporting & Conformance (DMARC) verifies email is authenticated against DKIM and SPF standards, and that fraudulent activity is blocked.
All MintzIT business clients under contract will have their email servers and protocols upgraded between March 13 and April 30. You should not notice any interference with your email flow or other IT activity.
If MintzIT is not under contract with your organization, we can still perform this work for you.
It is estimated this work will take no more than 2 hours, and can be done remotely.
To schedule your email security upgrade, contact MintzIT at 888.479.0690×1.
by Marc Mintz | Mar 10, 2018
Practical Paranoia macOS 10.13 Chapter 15 Email Update
Practical Paranoia macOS 10.13 Security Essentials has just updated chapter 15 Email. This update reflects recent changes in the GPGTools end-to-end encryption utility.
To download the updated chapter, click here.
Practical Paranoia macOS 10.13 is the best-selling, easiest, and most comprehensive guide to securing your Mac. Written with the non-technical user in mind, while containing all the depth expected by the IT professional.
Practical Paranoia Security Essentials for Android, iOS, macOS, and Windows are available from all fine booksellers, Amazon, with our digital Live! edition available exclusively from The Practical Paranoid.
by Marc Mintz | Feb 12, 2018
I’m not normally a fan of retelling quotes (well, unless I’m quoting myself), but my thanks to our brilliant Andi West for bringing this one to my attention. It is all the more relevant to our security and privacy today than ever.
by Marc Mintz | Jan 23, 2018
Practical Paranoia macOS 10.13 1-Day Workshop with Marc Mintz
Secure your Mac OS 10.13 computer from malware, criminals, snoops, and the whackadoodle ex. Concerned about being hacked? Your identity stolen? Your precious data stolen or encrypted? You should be. Hacking is a billion-dollar enterprise and everyone is a potential target. At risk are your personal and business messages, emails, photos, music, passwords, phone calls, internet travels, credit cards and financial data.
But in just a few hours you can easily and simply secure your Mac OS 10.13 computer to the highest government standards. Hands-on exercises ensure you leave with a secure device. Apply local and iCloud backup, strong passwords, system and app updates, permissions, whitelisting, hardware encryption, malware defense, and firewalls. Find a lost or stolen device, determine your network security level, securely browse the web, encrypt email, perform end-to-end encrypted messaging, phone, and video calls, and secure your Internet activity with VPN. PREREQUISITES: None. REQUIRED EQUIPMENT: Bring your Mac computer and backup drive.
Your instructor is the author of the best-selling, easiest, and most comprehensive macOS security guide, Practical Paranoia macOS 10.13 Security Essentials.
Each student will receive a copy of the digital online version of Practical Paranoia macOS 10.13 Security Essentials.
For more information and to register for the course, visit http://dcereg.com/index.cfm?method=ClassInfo.ClassInformation&int_class_id=83593&int_category_id=0&int_sub_category_id=0&int_catalog_id=0
Course ID: 82399
Date: January 31, 2018
Time: 8:00am-5:00pm
Location: UNM Continuing Education South Building, room 207
1634 University Blvd NE
Albuquerque, NM 87131
(505) 277-9562
by Marc Mintz | Jan 2, 2018
in macOS, a guest account allows a user to login with the username of guest, without a password. When logging out, anything created by the guest is deleted and the computer returned to its pre-guest status.
The “guest” user in current generations of macOS is built into the OS and cannot be removed.
However, that doesn’t mean you need to have it active. You can disable the guest user account so that it can’t log into the computer nor file share with it.
Most IT security pros would say to keep the guest user login on. Should the computer get stolen (or lost), this allows someone to log in to the computer, and trigger Find My Mac. Now you can see where it is at. With guest off, nobody can login, and you can’t find your Mac.
by Marc Mintz | Jan 2, 2018
What a great question!
The bad news is that for the technician to do their job, they normally need your PIN. Once they have your PIN, you have completely lost the security battle.
I recommend:
- Backup your device (to the cloud or computer).
- Reset/erase your device.
- Hand it over to the tech for service.
Note: assuming you don’t have a hardware problem, steps 1 & 2 get you halfway to fixing most problems yourself. To go the rest of the way:
3. Reinstall current OS.
4. Install your apps from fresh downloads.
5. Migrate your data to your device.
I’m most cases, you are now fixed.
by Marc Mintz | Jan 2, 2018
Whether or not you pay for something such as Facebook is not relevant to whether or not you are a product.
What makes you the product is if Facebook is making money from you other than any payments you may give. And they are. They make money with the information about your likes, your dislikes, the ads you hover over, the ads you click on, your friends, your games… the list goes on and on. In many ways, facebook, google, and their ilk literally know more about you than your mother. Such as your sexual preferences, your diseases, etc.
All of this information has become a multi-billion dollar industry (Facebook made $18B in 2016, google somewhere around $60B from ad revenue alone).
If these companies had zero information about you to sell to advertisers, your value would be significantly diminished. Perhaps to zero.