Are You Ready for Hardware Security Keys?

Are you tired of unlocking your phone or computer a hundred times a day? Would you like to login to all your favorite websites with a single tap, and never remember another password? That’s the promise of hardware security keys. Let’s take a look at the current offerings, and you can decide if one is right for you…

You Might Want One of These On Your Keychain

Last summer, “hardware authentication” was briefly buzz-worthy thanks to Google’s announcement of the Titan Security Key. It was pretty impressive to read that 85,000 Google employees who used Titan went a whole year without a single compromised account. Google urged everyone to upgrade to hack-proof hardware authentication. Today, you can buy the Titan Security Key for $50 in the Google Store.

Unfortunately, it doesn’t look like many consumers are buying Titan, or any of its competitors. Whether the problem is cost, convenience (another thing on a keychain), or apathy to security concerns, hardware gadgets like Titan and the Yubico YubiKey just have not caught on among private citizens. But that hasn’t prevented the rise of many copycat products, some of dubious quality.

Yubico, the leader of this small, slow-moving pack, has at least seven YubiKey products for various applications. The classic YubiKey 4 ($40 on Amazon) gets a 4-star rating average from 286 customers, making it the most popular model by far among Amazon shoppers. The YubiKey works with Gmail, Facebook, Dropbox, Twitter, Dashlane, LastPass and “hundreds of other services.” It’s also touted as waterproof, and crush resistant. Just plug YubiKey 4 into a computer’s USB port and tap the gold circle to activate. If you don’t want something that big on your keychain, the $50 YubiKey 5 Nano, works the same and is about the size of a dime.

The EveryKey wants to replace not only your passwords but also the heavy, noisy mass of metal keys you carry everywhere. Everykey generates secure passwords for your website accounts, and will unlock them with one touch. It also promises to unlock your phone, laptop, and at some time in the future, your house and car, as long as they have Bluetooth capability. When your Everykey is close to one of your devices, you can access it without a password. When you walk away, your device locks back down.

And yes, that’s antivirus pioneer John McAfee on EveryKey’s home page and in its video. McAfee claims he founded EveryKey in 2015, but fundraising for the venture seems to have started as much as three years earlier. EveryKey’s original $99.99 price has eroded to $59.20 on Amazon, where it has a 2.5 star rating average from only 22 customers.


The Fetian ePass NFC FIDO U2F Security Key ($16.99 on Amazon) sounds like a mouthful of acronym soup, but it’s not hard to parse. “NFC” means it works with Near Field Communication, the protocol that enables tap-and-go payments via smart cards or phones. “FIDO” is the Fast ID Online set of security standards developed by nearly 300 members of the FIDO Alliance to ensure interoperability. “U2F” is the Universal 2-Factor authentication standard developed by Google and Yubico. Customers give the ePass 3.5 stars. Complaints among a total of 89 reviews include dead-on-arrival units, another that failed after five months, and no tamper-proof packaging.


The Thetis Security Key ($16.95 on Amazon, is also FIDO and U2F compliant, and gets an impressive 4.5 stars from 181 customers. Unlike pricier products that leave delicate gold-plated contacts exposed, the Thetis’ rugged, foldable design guards against mishaps.

A Thetis reviewer made an interesting observation: “Technically, very few sites supports U2F protocol, BUT Google and Facebook are INCLUDED. And, as you know, Google and Facebook provides authentication for millions of sites. So, using U2F for Google and Facebook and using them for authentication covers, literally, millions of sites.” I guess he’s OK with Google and Facebook tracking every site he visits.


The cheapest gadget definitely looks the part. The U2F Zero is no more than a bare circuit board, probably hand-made to order by a geek named “Conor” at his kitchen table. But it’s U2F compatible, gets 4.0 stars from 60 reviewers, and it’s only $9.86.

Even though they seem handy, I think it unlikely that hardware authenticators will ever catch on as aftermarket purchases. Even the bare-bones U2F Zero is ten bucks that most people won’t spend to replace free passwords. But these devices may find their way into OEM devices, becoming a standard “accessory” just like a phone charger.

Are you interested in a hardware security key that can manage your logins, and unlock your gadgets? I personally have many passwords for many programs, websites, cellphone, computers and forget passwords on accounts in secondlife so much I purchased and use  YubiKey  for all. Of course keeping your passwords secure is always the key and changing them often helps in this. In weeks to come we will cover the how to on passwords and updates with these keys.

Have a great week

ZI STAFF

Oculus Quest vs. Oculus Rift

The Oculus Quest and Oculus Go are the new kid’s on the block, but can they beat the Rift?

Lets just make it simple Oculus Go as much as the price out shines Rift or Quest at $179 32gb and $279 64gb  even at entry level this headset will disappoint in many ways and that starts with the 3 point of view vs 6 point of view sensors to Rift and Quest and only one controller mouse vs 2 handheld controllers Rift and Quest. Okay need I say anymore? Now lets get to the meat of Rift and Quest.

In 2018 the Oculus Rift virtual reality headset had far more competition than when it launched, and much of it comes from Oculus VR’s other virtual reality products. While the Go is more of an entry-level headset, the Quest has the same price tag as the Rift, and many unique features which make it a worthy competitor for its older brother. To find out which is the best VR headset, we pitted the Oculus Quest vs. Oculus Rift in a classic head(set) to head(set) battle.

Design

The Oculus Rift is the older of the two designs and though it does show, it’s not an antiquated device. It sports a similar fabric-coated exterior to the Quest, a similar tri-strap adjustable head mount, and built in audio. But it’s not identical to the Quest. The Rift is lighter by a full 100 grams, due to the onboard hardware of the Quest, which includes its own processor and battery for wireless operation.

That does mean that the Rift trails wires, where the Quest does not, making the latter a much cleaner-looking headset, especially considering its newly revamped front plate, which wraps around the corners where the four Oculus Insight tracking sensors are located.

Instead of over-the-ear headphones like the Rift, the Quest comes with similar audio to the Oculus Go — a spatial audio solution hidden in the head strap. That makes it easier to hear what’s going on in the environment around you, whilst still being fully immersed in your VR experience. It’s not necessarily better quality, but it certainly makes it easier to remain present in both the real and virtual worlds.

Performance

The Oculus Quest is the most powerful standalone headset Oculus VR has ever produced, packing a Qualcomm Snapdragon 835 processor with onboard graphics, 64GB of onboard storage, and a battery that gives it between two and three hours of life per charge. As impressive as that all is though, it falls well short of what the Rift can offer, since the wired headset is tethered to a gaming PC. Oculus suggests much higher minimum specifications and the ceiling is far, far higher for potential performance than the Quest’s — think RTX 2080 and 2080 Ti graphics cards. Yet no matter how powerful the PC you hook it up to as well, there’s no concern about battery life, since the headset is powered by your PC via a wired connection.

Although that means that the Rift is capable of running much more detailed virtual reality scenes than the Quest — and for longer — its display has fewer pixels. The Rift’s dual-OLED panels are limited to 1,080 x 1,200 pixels per eye, working out to 2,160 x 1,080 resolution in total. In comparison, the Oculus Quest has twin OLED displays that are 1,600 x 1,440 each, or 3,200 x 1,440. That makes for sharper overall visuals, with a noticeably reduced screen-door effect on the Quest, but its in-game textures, shaders, and models are a far cry from the Rift’s PC-powered visuals.

The Rift handles high-speed motion better than the Quest too, because while its displays are a lower resolution, they have a higher refresh rate. The Quest runs at 72Hz, while the Rift has a fixed 90Hz. That should make it more comfortable for the user too, helping to avoid the dreaded VR nausea.

Tracking and controllers

oculus quest review 2

Both the Rift and the Quest offer high-end virtual reality tracking and inputs, but they take a very different tack with it. The Rift uses the classic external-tracker design using Oculus’  Constellation tracking cameras. Although they aren’t as capable a tracking solution as the HTC Vive’s Valve-developed Lighthouse trackers, they are perfectly capable of offering roomscale tracking in spaces up to 8ft x 8ft with three sensor set ups and more with four.

The Rift’s external trackers mean it’s possible to track the controllers almost anywhere you place them, whether that be behind your back or under objects — as long as they remain in the field of view of at least one camera.

In comparison, the Quest offers a theoretically unlimited tracking area thanks to its use of “inside-out tracking,” Insight sensors on the headset itself. One is located in each corner for a total of four and they scan the environment around the user, tracking their location and movements within it, as well as the motion of the controllers. Oculus debuted what it described as “arena scale” tracking at Oculus Connect 2018, where a number of Quest users walked around a tennis court-sized gaming area at the same time without any major tracking problems. This was further enhanced by the headset’s lack of any wired-tethers, letting users roam freely without being tied down.

However, the controllers must remain within the field of view of the headset’s wide-angle sensors in order to remain tracked. Early testing suggests their field of view is wider than the user’s, but tracking behind the back, or when the user is leaned in close to something, is unlikely to be possible at this time.

Each headset provides a full six-degrees of freedom to the wearer, tracking positional movements, as well as tilt and orientation of the headset, but each solution has its strengths and weaknesses.

Controllers are much the same for both. The Rift uses Oculus’ now classic Touch motion controllers which provide trigger, grip, and gesture inputs, and the Quest uses a modified version of those with a relocated tracking ring. Each provides for nuanced, detailed, inputs into virtual reality with the use of both the wearer’s hands.

Software

Having been on the market for more than two and a half years, the Oculus Rift has a library of games, VR experiences, and 360-degree media numbering in the low thousands. It has a variety of supporting marketplaces and ecosystems, including Oculus Home, Steam VR, and VivePort, and a robust developer and user base that all but guarantees continued support and growth in its content catalog in the future.

The Oculus Quest, on the other hand, is brand new and isn’t even set for release until Spring 2019. As it stands there are a handful of bespoke applications and experiences being used to demo the new hardware and there will no doubt be more when it is eventually released. But Oculus VR is said to be hoping that developers will port their existing Rift games to the Quest to help flesh out its library of content.

Although we would be surprised if the Quest didn’t have a decent spread of applications at, and soon after, launch, the Rift is going to have the more robust catalog of titles for some time to come.

Older VR, done well, wins out

There’s no denying that the Oculus Quest represents the future of consumer virtual reality in many ways. It’s entirely wireless and untethered, has a reliable and borderless — if still imperfect — tracking solution, and sports a more detailed display than its older sibling. In comparison, the Oculus Rift can feel quite antiquated with its chunky cable tether, its reliance on external sensors, and a defined tracking area. When combined with its requirement for a powerful gaming PC, it’s a much less intuitive and forward-thinking VR experience.

Yet with think the Rift is the better option. It’s not going to be the headset of the mainstream in the future and it’s going to feel increasingly dated in the years to come, but if you have a gaming PC, there’s a better VR experience to be had right now with the Rift. For the $400 that both headsets cost ($399 for the Rift with three sensors) you get access to a ton of content on the Rift, today, and its visuals, although less crisp, are much more richly detailed, run at higher frame rates, and are not restricted by battery life.

The cable tie is a drag — literally at times — and we would expect a second-generation Rift to adopt many of the exciting new features of the Quest, but for now, the Rift is still the more high-end VR solution.

The only real must in this setting is having a decent gaming PC. If you do, buy the Rift, if you don’t and don’t plan to, waiting for the Quest is probably a better bet.

Overall winner: Oculus Rift

The overall reason I am interested and vested in VR and these headsets is we are evolving into a new platforms with Sansar and High Fidelity and having the right gear in mind just makes sense. No this does not mean Second Life is dead! But it does mean we have other choices to enrich our online world experience although still in its infancy VR headsets will be our new standard years down the road. However many won’t transcend  with the new technology as easy.

Have a great week

ZI STAFF

Virtual worlds: High Fidelity vs Sansar

Years come and go but the question remains always the same: what the virtual worlds are concretely useful for? Virtual worlds like Second Life, that despite it’s not to the top of the fame anymore still attracts 900 thousand players a month, Sansar, the so called “new” Linden Lab‘s project that should start its open beta full on January, or High Fidelity, the new adventure of Second Life’s “daddy”, Philip Rosedale, that started already its open beta with 69 virtual worlds online at the moment.

High Fidelity wanna be the new web

An univocal answer has yet to be established, as confirmed article on Wired where Rosedale has confirmed to believe that High Fidelity could become, as Second Life should have been, “the new web”: “”High Fidelity is the internet. High Fidelity is not a company or a thing. High Fidelity is the net”.

That’s why High Fidelity is peer-to-peer, it was designed as a system of interconnected servers to realize a virtual world even wider than the real one, intended to resolve two of Second Life’s most persistent problems, scale and latency (since Second Life was built on Linden Lab’s servers it suffers of persistent lag problems and can’t host more than 40 avatars contemporary in a single sim), making money by charging a fee for domain registration, i.e. by acting as a “Go Daddy for VR”.

Open or closed platform

In order to do that and to give way to the people “to build anything they want” this time Philip Rosedale decided to develope an open platform, the opposite of Second Lilfe and of what has decided to do Ebbe Altberg with Sansar, developed as a closed platform for single experiences, to make possible to realize a crowd of virtual settings on small scale.

Alberg has invested a lot on Sansar, directing it towards VR as soon as Oculus Rift was bought by Facebook in March 2014 for 2.4 billion dollars: “we knew that people were going to want to create content” for VR in massive quantities, which right now “it’s too damned difficult” underlined Linden Lab’s Ceo on Wired.

Sansar, not connected settings

virtual worlds: SansarLess defined of in terms of graphic details, Sansar compared to High Fidelity appears to be based on a consumer-facing approach rather than a geek approach and as if in the case of the Philip Rosedale’s platform even Sansar wants to give the possibility to players to create their own VR content, its settings can be replicated, not connected.

Basically if two school group are visiting the VR reproduction of an Egyptian tomb, both can contemporarily wander inside, but they won’t be seen and they won’t interact among them because they will be in two identical but separate settings. Spaces that, like the current internet sites can be owned by big corporations or by individuals.

A different content management

Even VR content management will be different between High Fidelity and Sansar: while in High Fidelity users will be able to create and modify contents inside the platform, just as Second Life users do today, in Sansar it will is necessary to create or to modify the contents to the outside, for then to import them in the platform.

On the other hand this will reduce the necessity to memorize contents and will make useless the same idea to have to install and to interconnect servers among them as for Second Life (and High Fidelity). More similar to a game and less to the properly said virtual worlds, maybe, but Sansar will be enjoyable from that vast mass of consumers who doesn’t necessarily care to create contents, but rather to enjoy of it.

What virtual worlds are for?

virtual worlds: Second Life

Altberg and Rosedale regularly meet, to discuss of their own projects and of corresponding visions about the future of virtual reality, they are “frenemies” according to a definition of Altberg. Who knows if comparing themselves they will succeed in finding an univocal answer to the question: what virtual worlds and virtual reality are for, other than to realize beautiful graphic contents?

Till now with over million VR headsets sold and the New Oculus Go and early 2019 Oculus Quest sure to peek more interest still nobody is able to say it for sure, nor to ensure that, passed the initial enthusiasm, you don’t forget VR as already happened at the end of the eighties.

I say try it for yourself see what the hype is VR has come a long way since the first Oculus Rift was born. And although its still in infancy with High Fidelity and Sansar it still holds my interest  as there is so much more that is going to happen and I want to be there as both VR worlds develop. Also there are some really cool things you can do with Oculus such as Live concerts and sports, Realistic gaming and some virtual interactive movie’s that will scare the proverbial crap out of most.

Zoha Islands will be seeing you in VR real soon

Have a Happy and Safe New Year 2019

 

 

 

HARD DRIVES! Is Yours SMART Enough?

People sometimes ask me, “How long will my computer’s hard drive last?” Lacking a crystal ball, all I can say is that some factors can be monitored to provide you with early warnings that it’s time to get serious about making frequent backups and shopping for a new drive. Learn more about S.M.A.R.T. and other tools to monitor the health of your hard drive…

Hard Drive Health Check

Over time, hard drive makers have learned that there are traits of a hard drive that change as it approaches failure, providing tell-tale signs that a data disaster may be approaching. The industry standard for hard drive “failure anticipation” is called Self-Monitoring And Reporting Technology, or S.M.A.R.T. for short. In this article you’ll learn how it works, how you can take advantage of it, and if it’s a reliable indicator of the condition of your hard drive.

Hard disk failures arise from two general types of factors: 1) sudden, unpredictable catastrophes such as falls onto concrete floors or zaps from cosmic rays, and 2) gradual, relatively steady deterioration of mechanical components until one of them fails. About 60 percent of disk failures are due to the latter, predictable sort of factors; these are what S.M.A.R.T. monitors.

Traditional hard drives employ spinning magnetic platters, and S.M.A.R.T. monitors the rate at which the bearings under them are wearing, for instance. Using that rate, S.M.A.R.T. predicts when a bearing will be worn to a specified degree, called the “threshold value” for bearing wear. When S.M.A.R.T. determines that a bearing is X days from that threshold value, it generates an alert that effectively says, “Captain, she’s about t’blow!”

Dozens of such factors can cause a hard drive failure and are written into the S.M.A.R.T. standard. Every drive manufacturer is free to choose which factors it wants to monitor and what the failure threshold values will be for its drives. S.M.A.R.T. has evolved through three phases. The current phase goes beyond monitoring and reporting to actively attempt to prevent or forestall drive failures. Modern S.M.A.R.T. drives will try to “heal themselves” by reallocating data from disk sectors that are near failing to reserved “spare areas.” They still can’t change their own bearings, though.

How Can I View My S.M.A.R.T. Reporting?

For a quick look at your hard drive’s S.M.A.R.T. status, try the free Speccy utility. In the Hard Drives section of the Speccy results, you’ll see some technical gibberish under the S.M.A.R.T heading. If it says “Status: Good” at the bottom, that’s about all you need to know. The only other info there you might want to check out is the Reallocated Sectors Count. If that’s greater than zero, you may have some defective sectors on your hard drive.

For a more detailed look, you can monitor S.M.A.R.T. factors using software such as Argus Monitor for Windows or Disk Utility for Mac (in the Apple App Store). But before you shell out money for either program, you may want to know just how reliable a predictor of drive failure S.M.A.R.T. really is.

How Smart is S.M.A.R.T?

Google spent nine months monitoring over 100,000 drives back in 2007. A paper entitled Failure Trends in a Large Disk Drive Population reported the results. Four “strong” S.M.A.R.T. factors were identified as the best predictors of drive failure; the bad news is that 56 percent of the drives that failed did so without reporting a threshold level in a single one of these factors. So S.M.A.R.T. data alone is of limited value in predicting when a drive is going to fail.

Another issue is that S.M.A.R.T.’s implementation can (and does) vary widely from one manufacturer to another. There are dozens of S.M.A.R.T. factors that can be monitored, but a manufacturer need only implement one in order to legally call its drive “S.M.A.R.T. compatible.” Some removable drives cannot be monitored at all, or only with certain proprietary software such as Argus Monitor.

The bottom line is that S.M.A.R.T. won’t give you warning of impending drive failure with a high degree of reliability. I would not spend much time monitoring S.M.A.R.T. factors, and I definitely would not spend any money to do it. That said, it does predict failure in some cases, and if you do see a S.M.A.R.T warning along the lines of “SMART Failure Predicted on Hard Disk. Failure may be imminent” it should be taken seriously.

Other Hard Drive Health Tools

A disk checking utility called CHKDSK comes with Windows, and it’s pretty good at detecting bad files and physically damaged sectors. It will lock damaged sectors so that the computer will not attempt to write to them. To run CHKDSK, first open the “Computer” window. Right-click on the icon for the hard drive you want to check, and select Properties. On the “Tools” tab, click the “Check Now” button under Error-checking.

I’ll also repeat my bottom line advice: Most of the time, hard drive failures happen at unpredictable and inconvenient times. So backing up your data regularly is vital, and is your best defense against loss of data.

HAPPY CHRISTMAS FROM ALL OF US ON THE ZOHA ISLANDS TEAM

 

 

Email Bomb Threat Has Ties to Earlier ‘Sextortion’ Scam

The mass email bomb threat on Thursday that turned out to be a hoax was likely perpetrated by a group of spammers who have also been scamming people with an email ‘sextortion’ scheme, according to Cisco’s Talos security group. Our e-mail server was hit a few times during the past few weeks and is the reason we are making this post.

Thursday’s mass email bomb threat has been connected to a group of spammers who’ve also been bombarding inboxes with “sextortion” messages claiming to have recorded people watching porn.

Both email scams have been using the same IP addresses to send out the extortion messages to inboxes across the world, according to Cisco’s Talos security group, which said the spammers have been changing tactics in an effort to scare victims into paying them Bitcoin.

“The criminals conducting these extortion email attacks have demonstrated that they are willing to concoct any threat and story imaginable that they believe would fool the recipient,” Talos security researcher Jaeson Schultz wrote in a Friday blog post.

Bomb Threat Email Example

Thursday’s email bomb threat sparked alarm across the US; schools, businesses and community centers ordered building evacuations on fears the threat was real. However, the messages all appear to be a hoax, and so far police have discovered no explosives tied to the scheme.

It wasn’t the first time the spammers used empty threats to scam victims, according to Talos. In October, the company’s security researchers documented a mass sextortion campaign from the group that had been going on for months. It worked by scaring victims into thinking a hacker had taken over their computers and recorded them watching porn. If you wanted the embarrassing video kept secret, then you had to pay up.

Although the sextortion threat was a scam, the spammers were able to make at least $146,000 from the mass email messages, according to Talos’ research. It now appears the spammers have decided to go beyond threatening mere individuals to entire businesses and organizations as evidenced by yesterday’s bomb threats.

In an interview, Schultz said he estimated that the spammers sent “tens of thousands” of email bomb threats to people’s inboxes on Thursday before deciding to stop by the evening. Schultz made the estimate based on copies of messages detected by Cisco’s spam filtering solution, SpamCop.

Countries targeted by the bomb threats included the US, Canada, New Zealand, and Australia. But the emails themselves were specifically sourced to IP addresses belonging to a domain registrar and hosting provider in Russia, called Reg.ru. According to the Schultz, the spammers probably hacked accounts for domains hosted by the Russian provider to mass email the bomb threats.

Each IP address sent out only about 5 messages, none of which contained any malware. This may explain why the spam filtering on some people’s inboxes let the bomb threats through. “That small quantity per IP made it much more difficult to use the reputation of the IP address to block the mail,” Schultz said.

Talos noticed that the spammers were using at least 17 bitcoin addresses to receive their payments. But none of the addresses received the $20,000 extortion fee the culprits were seeking.

“They definitely didn’t make much money on this bomb threat,” Schultz said. But the scheme also backfired in attracting unwanted attention from US authorities, including the FBI and police departments across the country.

“With each new email campaign, there is a chance that the attackers will make a mistake, or otherwise give away a critical piece of information that may implicate them,” Schultz added.

Who, exactly, is behind the bomb threat isn’t known, but they appear to be changing tactics. “As of late yesterday, the bomb threat email attack morphed,” Schultz wrote. “The attackers have returned to their empty threats of harming the individual recipient. This time, they threaten to throw acid on the victim.”

Acid Throwing Threat Email

This new round of extortion emails have been sourced to different IP addresses coming from a separate Russian hosting company called TimeWeb. But Schultz suspects yesterday’s email bomb spammers are also behind the acid-throwing extortion’s scheme. That’s because the messages have been using identical subjects lines and similar text, he said.

Unfortunately, the spammers probably won’t stop unless they’re either caught or people stop falling for their extortion schemes. “DO NOT pay extortion payments,” Schultz advised. “Doing so will only confirm for the attackers that their social engineering approach is working, and victims’ money goes directly toward facilitating additional attacks.”

As I have said before DO NOT play into these threats. DO NOT open unknown e-mails and lastly DO NOT EVER be held hostage with your information. Secure your accounts NOW change your passwords frequently and for GODS sake don’t share your information with anyone unless trusted, when in doubt check’em out.

Have a great week from all of us on the ZI STAFF

Got Malicious Chrome Extensions?

If you are like most Chrome is a staple in our everyday internet lives as well as the extension in Second Life web browser.Your web browser is your first line of defense against all manner of cyber attacks. But some disturbing reports of malicious Chrome extensions that resist most manual removal efforts have led me to wonder just how good Google is at keeping malicious extensions out of the Play Store, and how committed Google is to doing so. Read on for the scoop…

Is Google Doing All It Can To Protect Against Malicious Chrome Extensions?

Google puts a lot of effort into making the Chrome browser safe and secure. But when third-party extensions are added, your level of security may drop to zero. Browser extensions have nearly full access to the web pages you visit, so in addition to spying on your activity, a malicious extension can steal passwords, user your computer to mine cryptocurrency, and make you an unwitting participant in click fraud schemes.

The recent discovery of a uniquely stubborn rogue extension quickly led to revelations of others, and to the company’s alarming admission that over a thousand malicious apps are uploaded to the Play Store every single month. Equally disturbing is Google’s apparently lackadaisical response to the first extension; after being notified of its presence, Google took 19 days to remove it from the Play Store!

A company spokesperson stated that this extension and another user-resistant malicious app were “automatically removed… from the machines of affected users.” Now, “automatic” implies “fast,” but these removals did not happen until hours after Ars Technica published a post about them and the weeks-long delay in getting attention paid to the first one!

Malicious chrome extensions

The malicious apps in question were “Tiempo en Colombia en vivo” (Weather in Columbia Live), a Chrome extension, and “Play Red Bull version 4,” ostensibly a children’s game that runs in Chrome. They are both gone, but the way they were handled has left a sour taste in many mouths.

James Oppenheim, who reviews children’s games professionally, is one of those whose lips are twisted bitterly. The rogue “game” contained a logo that named his site, jamesgames.com, as the official home of the malware! James notes that he has never written an extension; he reviews games, he does not create them. appears that whoever published it knows enough about what I do reviewing kid’s software to think that my name would help make the malware more trustworthy,” Oppenheim told Ars.

Adding insult to that injury, he says that a week after he reported the offending app via the “REPORT ABUSE” button on its Play Store page, he had absolutely no response from Google and the malware remained available… and aimed at children, mind you!

You can protect yourself by installing only browser extensions to those that are well-established, with many thousands of positive reviews, and preferably millions of existing users. The Chrome Web Store displays star ratings, and the number of user reviews on the category pages. When you click to see the details of an extension, you can see how many users have installed it, and read the reviews.

The “game’s” page said it had 27,781 users at the time Oppenheim investigated it. Many of them posted warnings that the thing was malware. “Makes me wonder how seriously Google is taking this problem,” he said in his email to Ars Technica’s Security Editor, Dan Goodin.

Fumbling the Ball

I wonder too. Google’s spokesperson didn’t even get the word “Ball” right in the response that Goodin finally received, substituting “Bull.” Funny, that’s exactly what I think is Google’s response to this security failure! There’s a lot more to this story as told by Oppenheim and Goodin, but I think we have the gist: Google didn’t just fumble the ball, it was disgracefully late to the game.

I mentioned earlier that 1000+ malicious apps are uploaded to the Play Store every month, and the great majority of those are automatically flagged and removed. So it’s not fair to say that Google isn’t trying to protect their users. But you can only do so much with automation. When you’re dealing with numbers of users in the tens or hundreds of millions, a success rate of 99.9% is not nearly good enough.

I get it: Google Chrome is the world’s most-used browser by several country miles; it’s the first and often only target of every hacker. But Google knows that, and Google has plenty of money to throw at problems like this. If they don’t have enough people to handle problems like this, I refer you to the previous sentence. When problems are pro-actively reported by real humans who are saying “Hey, this is malware!” they should be acted on swiftly.

This sort of failure to protect, and delay in remediation, and defense of indefensible obtuseness, is simply unacceptable. Google, you must do better here. If you want better security just DON’T Use Chrome or it’s apps! Its really that simple use Firefox or Windows built in browser and make damn sure you have malwarebytes and a good anti-virus program and know where your apps are coming from.

Have a safe week from all of us on the ZI Staff