Cybersecurity: Seems Most People Think Most Cybercriminals are Uberhackers... They aren't!

One of the things I do on Reddit is hang out in /r/cybersecurity_help, and tell people what they claim was impossible. Like "I got hacked through ______". 

I don't mind people not believing me. Honest truth is sometimes hard to believe, or let's use Chinese proverb, 忠言逆耳. 

Two MONTHS ago, someone decided to post a portion of their iPhone's log, believing it contains evidence of them being monitored. Except it contained no such thing. It's quite easy to Google all the suspicious keywords like "tracked" and "proactiveHarvesting"... They are all built by Apple. So I replied there's nothing here that indicates anything about you being monitored. 

OP pivoted to a different theory, like "what if they hack me through Bluetooth or something else? I can find evidence of intrusion? "

I replied that you can't be hacked through Bluetooth nowadays, esp. if you have a modern iPhone and keep stuff updated. And evidence of intrusion had to be gathered by forensic analysis. It's not something regular folks can just run an app and "voila, evidence!". 

Then yesterday, some OTHER random guy decided to necro the topic from 2 months ago (and even OP had left the topic), and started blabbing about "Bluetooth hacking, just search for it."

As a cybersecurity professional, I am QUITE familiar with state of Bluetooth hacking. With noderm iPhones, the best you *can* do without some Zero-day exploit was Bluespam (keep popping up "trying to connect") 

There are other Bluetooth hacks, but they don't result in being able to control the iPhone. Just to summarize: 

Bluejacking -- the targeted user accepts the pairing attempt from a peripheral, which of course, results in the peripheral, acting as a keyboard and mouse, gaining some control of the iPhone. This is NOT done easily, as the user must ACCEPT the pairing attempt. It's not done invisibly or automatically. 

Bluesnarfing -- by using some exploits on VERY old firmware, hacker can transfer files the target phone. Again, only on very old firmware with problems. And most files "shared" this way are just regular stuff, like calendar, contacts, photos, texts, videos, and such. Stuff you normally use BT to transfer. They can't suddenly reach out into Banking app and take your account number and balance (at least, not with bluesnarfing alone). 

Bluebugging -- the most dangerous, but requires a VERY dangerous exploit that basically gave the attacker full control of the device through Bluetooth. You pretty much have to be running ANCIENT (like 5-10 year old) hardware and firmware with no security updates. 

Blueborne hacking -- a bunch of vulnerabilities discovered in 2017 (yes, 8 years ago) that got grouped together even though they are spread across iOS, Android, Windows, and even Linux, and some embedded OS, due to a Bluetooth problem. When it came to iOS, Blueborne problem was... an audio protocol over Bluetooth, called LEAP: Low Energy Audio Protocol. Guess what iOS was this fixed in? iOS 10. That's right. iOS 10. We're now on... iOS 18.5. 

Really, that's it. 

So I replied something like "Bluetooth hacking is from YEARS ago and usually doesn't even involve smartphones, but peripherals." 

His reply? "Those Flipper devices are something huh?"

Except there's only one: Flipper Zero, and while it *can* "hack" BT and BLE, the worst they can do to iOS is Bluespam. They are not capable of anything like Bluejack, Bluesnarf, Bluebug, or Blueborne. So it's completely irrelevant to the original topic. 

What was the purpose of the reply and who was he supposed to impress by mentioning a few keywords? I honestly have idea. Was he expecting to stump me? 

Frankly, to the average "civilian" (who's not in cybersecurity), the "hackers" seems like wizards, when most of them are actually scriptkiddo that can barely follow instructionss on a PC. They may be lead by someone who's somewhat more skilled, but they are hardly a "live in parents' basement" misunderstood genius stereotypical geek. 

Cybercriminals are usually NOT uberhackers. They can barely follow standard script. They are worse than scriptkiddies (or scriptkiddos). 

In fact, most civilians can't even distinguish device being hacked vs. account being hacked. 

Whether this is due to lack of compuiter literacy, I have no idea. 

And with the advent of AI, which can be used to further disguise the lack of compute literacy, things can only get worse. 

Guess that keeps us cybersecurity experts employed. 

App(s) Discovery: Files (Community) and FilePilot, two Explorer Replacements or Complements

Recently, I came across two different Windows Explorer "replacements or complements". Let's face it, Windows Explorer can get a facelift, but the codebase is ancient. What if someone started from scratch? And here we have two different visions... 

Please note that Microsoft never gave us a way to completely replace Windows Explorer, so there are various "hacks" including registry changes, call intercepts, and so on, but they all have pros and cons. Just beware. 

Files / https://files.community/

Files is a slick looking manager that's completely free. They do suggest you "purchase" it from the Microsoft store to enable auto-patching and thus support them with a bit of revenue, but it is optional. 

The interesting thing about this explorer replacement just about EVERYTHING visual is configurable. Want a background? No problem. Zoom, unzoomed, specific percentage, specific alignment, etc. etc? Can do. Color themes? No problem. Want certain UI elements to appear in a different location? No problem. 

But by default, it looks a lot like Explorer... multiple tabs, etc. That is, until you find the "settings" button at the bottom left. Then everything changes. 

This is free, so just go download it and give it a try, eh? 

FilePilot / https://filepilot.tech/

FilePilot is extremely speedy and free during the beta period. In fact, the download is LESS THAN 2 MB. While the visuals are not as configurable as Files, the UI is extremely slick, with the mouse wheel picking many of the options, such as the different views of files, from large, middle, small icons, to file list, details, and so on. It also supports command palette. EVERYTHING is lightning fast... 

In fact, why don't you just go give it a try? They probably will stop the beta sometime later this year, but in the meanwhile, the beta should still work fine. And you *may* find it useful enough to pay for the full version... even in the current beta state. 

App Discovery: UnigetUI, the almost-universal Windows Patcher

Windows 10 and 11 actually has multiple methods of self-updating ASIDE FROM Windows Update. However, they are reserved for powerusers, not regular users, as most rely on command-line interface (CLI). Such as Winget, Scoop, Chocolatey, Pip, Npm, and more. Though to be honest, NPM is more for Node.js, and PIP is more for Python, but they are there, and they are used on Windows quite a bit. 

One user, Marti Climent, decided to change that, and came up with UnigetUI, which is a graphical interface for all those different sources, combined into one app. 

Between this and Patch My PC's Home Updater, they should update just about EVERY app you have on your PC. 

Now you have NO excuse to NOT keep your PC's apps updated. 

App Discovery: Patch My PC Home Updater, keep your apps updated easily!

I've touted many times before the 3 simple cyberhygiene rules of Brian Krebs, one of which is keep apps updated. But some apps update themselves (but you have to run them), some have external updaters, some relies on Windows update... 

Now, there is Patch My PC's Home Updater. That's right, there's an app that will scan your home PC, find the apps, and update them for you, with minimal headaches. 

While this doesn't replace ALL updaters, this will do about 80% of the updates. Just run it periodically (say, once a week)... Start it up, and just hit "update" and walk away. Come back in half an hour, and it should be done. 

How easy is that? 

You can also use this to FIND new apps to install by browsing the library of apps they scan for. These scan for mostly free alternatives to famous apps, and thus, you may discover apps that does what you pay monthly or yearly for. 

And of course, it will UNinstall apps you no longer want to use, which is another one of Kreb's cyberhygiene rules. 

So give it a try. 

For the few apps this won't update, there's another app I will recommend... in the next post. 

App Discovery: Spacedesk by Datronicsoft

As you use more and more tech, you object have extra old tech left over. If you have an old tablet left over, have you wondered what you should do with it? 

How about turn it into an extra display for your desk accesories that you don't want to take up extra desktop space? 

I have an old Nexus 7 (2nd gen) tablet, too old and too slow for 2025, but it's fast enough to act as a secondary display. I cleaned it up (removed all the old apps I don't use), uninstalled a bunch of crap, then went to 

https://www.spacedesk.net/

And downloaded the "driver" for the PC. Then went to Google Play Store (yes, my Nexus 7 can still access it) and downloaded the Spacedesk app.  I connected the USB cable between the 2, set the tablet on file transfer mode, fiddled with it a bit, the driver software saw the app, and voila, I have a 4th screen. 

This will also work in Wifi, but wired is more secure and faster. 

My triple-wide desktop, now with a small 4th display.
I stuck my desktop widgets and other stuff there.  

The software is FREE for personal use. If you have Spotify or Stock Ticker or Weather, Clock, and so on, put in on that display for extra clean look of your desktop. 

And happy "Pi" Day. 

(3/14, get it?)

Cybersecurity: How Do You Know If Your Antivirus is Working (without actual Malware)?

Antivirus is a lot like having insurance... you have it, but hope you never have to use it. 

What if I tell you that you can test your antivirus on your PC, without downloading any malware, by simply typing something on your keyboard? If it reacts, the antivirus is working. If it didn't... your antivirus' real-time scan is not working. 

This only works on Windows, by the way. 

Open a powershell window. (If you don't know what is Powershell, please read this from Microsoft. It's already in your system.  https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/powershell )

What you will type or copy is just a string, a bunch of characters. It is NOT a script or malware. It is offered by Microsoft as a way to test their own AMSI (Microsoft Antimalware Scan Interface)

Enter this at the prompt:  ‘AMSI Test Sample: 7e72c3ce-861b-4339-8740-0ac1484c1386’ 

Note, please replace the fancy quotes with single quotes to get this to work properly. Yes, the single quotes are important. 

Microsoft Security should trigger as you press enter. Depending on whether you have any clipboard management software, it may react as soon as you try to copy the string onto the clipboard. 

Now you know whether your antivirus is active or not. 

There are, of course, other ways to test this. For this method (all credits goes to Black Hills Info Sec) and other ways, go read BHIS's blogpost: https://www.blackhillsinfosec.com/is-this-thing-on/

App Discovery: Destiny, the secure cross-platform file transfer method

Want to transfer a file across platforms (Windows, MacOS, iOS, Android, Linux) but can't find common ground? Destiny can help. Download from

https://github.com/LeastAuthority/destiny?tab=readme-ov-file#installation

There is nothing to set. If both platforms are on the same network (i.e. phone to PC, or vice versa), simply sender run the app and pick SEND, and receiver pick RECEIVE. Then sender choose the file to send, and a passphrase is generated, easy to type in English. As soon as receiver type in the same passphrase, file transfer will start, and since it's happening at local network speed, it's almost instantaneous.  

The client, using "magic-wormhole" protocol, will automatically negotiate alternative protocols if you are on different networks, through the Internet, and so on. And the traffic is encrypted. No interception. Remember, cross platform too. You can go any client to any other client. You can send the passphrase through any "normal" means: SMS, encrypted chat, email, or even call them up and tell them. 

I've tested Android to PC and vice versa on local network. It works great. Previously I had to rely on Google Drive or DropBox to sync the files, and I've also purchased a "Wifi Server" where the Android app hosts a GUI that allows a browser to access the local storage. First is slow, second is a little PITA to run. This manages to be neither. 

My only nitpick is you can only transfer ONE FILE AT A TIME. For each file, you have to initiate a send, and thus, a new passphrase. Not quite frictionless, but for the amount of security it provides, it's almost unbeatable. 

So if you need to frequently transfer single file between your devices, this is a very simple way to do it. Worth a try, at least. 

Windows 11 Audio Weirdness: Bluetooth vs Wired, Headphone vs Headset, and More

I do some Youtube videos and one of the ways is to use NVIDIA Shadowplay to both capture the foodtage AND to add live commentary. However, it seems that Win11 has changed the way things are set it's a royal PITA to connect Bluetooth headset, but only use it as Bluetooth headphones. It seems you cannot "choose" that, but you have to disable it under Settings // System // Sound then find Microphone section, find the Bluetooth microphone, and click on "don't allow". 

There are other ways, but they come with additional drawbacks. One of the ways offered up by Google via one of the forums was go into Device Manager and disable the device's "AVRCP" protocol driver. However, this has several problems. a) if you disable AVRCP, Windows will not detect your headset as a headphone, but as a hands-free device. What's the difference? A hands-free device, in order to give microphone fidelity, HALVES the audio transmission quality of whatever you're receiving. Since we're NOT using the microphone, and Bluetooth already has lousy audio quality (and Qualcomm's AptX supposedly helps with that, but is obviously exclusive to Qualcomm chipsets) this is a very bad compromise. 

App Discovery: EaseUS Todo Backup 2024

The free PC backup utility space used to be dominated by Macrium Reflect. Unfortunately, it is a bit TOO good, that most people just use the free version and not enough people pay. In 2024, Macrium phased out the free version. This lead to a hunt for a replacement. And I've found that EaseUS Todo Backup 2024 seems to fit the needs of most. 

Photo by Jandira Sonnendeck on Unsplash

EaseUS is a well-known PC utilities provider using the freemium model in the US, and offers a full range of PC utilities centered around data storage, such as partition manager, data recovery, backup and restore, disk cloning, and so on. Today we will concentrate on their Backup solution, Todo Backup Free. 

Do keep in mind that in order to "encourage" you to upgrade to Todo Backup Home, the free version's throughput is limited to 100 MB/s or so. So expect a typical backup job of 1TB to take about 2-3 hours, which means this should be scheduled for overnight. 

With that limitation in mind, this is a full-featured backup which allows full backup, incremental backup, full disk backup, partition backup, even individual files and folders backup. 

The upgrade pricing is a bit weird, as multiple options are offered: yearly plan, one-time (no upgrade), or perpetual upgrade. At this time, the yearly plan is $40, the one-time fee is $60, and perpetual upgrade license is $80. All of this is for one computer only. However, please do NOT buy from the website. Download the free version and try it first. 

If you hit upgrade from the app, the price is only $30 per year, instead of $40 on the website, and lifetime upgrade price is $59, not $80. But anyway, PCWorld has a discount code: PCWORLD25 for 25% off the $30 yearly price. 

EaseUS does offer bundle savings, but you need to check their website for details. 

Personally question the utility of cloud backup, unless you have a very wide pipe broadband (cable or fiber). I think you can do better with a local RAID setup, but that's just my opinion. You should check PCWorld's Cloud Backup survey (May 2024) for their opinions. 

But you do need a backup. Please go download the free solution and make one now. Your hardware can go down. You could be hit by malware such as ransomware. And so on. Better be safe than sorry. 

PC Macroboard Update: I Bought One! Epomaker EK21 VIA

Sometimes, somethings are just too good of a bargain you can't pass it up. And when I saw a macroboard available for sale, it took me several minutes to decide to take advantage of it. 

I am buying this: Epomaker EK21 VIA

Epomaker EK21 VIA, courtesy of Epomaker.com

You may be asking: so what? It's a numpad. 

Ah, but it's a triple mode numpad: wired, Bluetooth, and dongle-wireless. 

Okay, so? 

It's also VIA firmware customizable. No proprietary software needed. Use the nearly universal VIA website to map everything, from macros to layers. And it has a knob in the upper left corner. It's RGB, hot swappable switches, And it has 4 layers (0 through 3), and can be paired to up to 3 devices under Bluetooth. No more struggling with proprietary macro software. 

And the best thing is the price. It's on sale for $33.99, and there's a $5 off coupon you get if you do the spinner game on their website. Shipping from China is free. Final out the door price: $28.99. No tax either. 

I can easily program the RGB lights to indicate the layer mode, which means I have 20 keys and 1 knob to program * 4 layers to map. Even if we take away 1 key as layer switch, that's still 19 keys + 1 knob x 4 I can map actions to. 

The only thing that could be better would be it has a display, like Stream Dock or XenceLabs macropad. And those are $100. Maybe discounted to $80 if I find it REALLY on sale. And they don't have nearly as many keys as this. For saving $50+ dollars, I can live with the limitations, esp. if I find my "relegendable" keycaps I stashed away somewhere. 

App Discovery: Ninite -- Install or Update MANY Programs at Once

Ninite, available at Ninite.com, is a tremendous timesaver for people who need to keep PCs up to date or standardized on certain number of free or freemium programs, and it has a wide selection and is extremely easy to use. 

Basically, go to Ninite.com, and select which of the programs you want the installer to download and install by ticking its checkmark. 

Ninite Installer Config (as of 2024/06/16), bottom's cut off... Ninite.com

As you can see, it will install or update ANY of the programs on this list, from security tools to web browsers, from messaging and email apps to compression utilities, from media players (video, audio, etc.) to developer / programming tools, from image editor/viewer to system utilities, PDF viewers, and other commonly installed toolsand apps. Once you chose all you wanted, click on the Ninite button to download the installer. 

Then you can run this installer on any Windows computer, and it will download and install EVERY program you chose from the list, WITHOUT ASKING you to confirm anything. EVERYTHING will be done automatically, no user prompting, no confirmation, completely automated install like systeadmin magic powers... And it's all free. 

So if you need to keep 10 computers on the latest version of various apps, just make 1 Ninite installer, and run it on all 10 computers (probably with some sort of USB drive). Run it, and walk away to do something else. It'll be done when it's done. You'll probably still have to run each app to config it, but that's easy enough, right? 

For individual users, this is easier than running X programs one at a time to engage the auto-update for each one. 

So give it a try, eh? 

When in Doubt, Reboot! (It actually works)

It is now 2024, and the the latest CPUs have dedicated AI cores. Unfortunately, the old adage "when in doubt, reboot" still applies, even with Windows 11 and Android 14, the latest and greatest, esp. if you left both running for a long while,  and they start to glitch out. And that gets extra annoying. 

Photo by Mitesh on Unsplash

Just now, I had a hard time trying to reconnect Microsoft's Link to PC to my Pixel 6. It had worked fine for several days, but just today, it won't maintain the connection. It'd just disconnect after appearing to reconnect, then pop up with an error and ask me to relink via a QR code. Tried stopping the app on the phone and end task on the PC, neither worked. Ended up restarting the phone, the connection became stable. 

As an IT professional, I *will* tell you that a reboot solves 99.5% of all problems. You will lose a bit of work, but most modern apps autosave your progress... usually. 

But have you ever wondered WHY computers glitch out, and require a reboot? 

Because computers are made by humans, and humans write the programs that runs on computer. 

Generally speaking, programs all have bugs. By the time the programs reach you and me on our PCs, the major bugs have been squashed, and it's only the smaller and undetected bugs that remained. The smaller ones are judged to be tolerable. It's the hidden ones that makes program behave... glitchy. 

Programs typically asks the operating system (OS) for a chunk of memory for its own use, and was supposed to release such chunk when it is done with the chunk, so the OS can reissue them to another program. In practice, this "release" is rarely done, and each program ended up with a LOT of small chunks of memory, and when the program itself crash, NONE of those little bits of memory was released back to the OS. The end result is a program that increasing lost track of its own memory, the longer it ran, the worse this gets. 

It is typically recommended that you reboot your smartphone ones a day, maybe once every two days. And a PC, probably once a day or twice a week. 

And your computer will really feel more responsive after a reboot, and programs will crash less. 

What Utilities for My Own PC?

If you've been on Youtube long enough, you've probably seen a couple videos where each Youtuber makes a list of "You Must Try These Programs". But chances are, only a few of them would be useful to you. 

Let me go through my own setup, and I'll explain why each of them are useful to me in one way or another. If it's not noted as freemium or paid, then it's free. Maybe you'll find something useful for yourself. I am on Windows 11. 

Photo by Sebastian Bednarek on Unsplash

Audio

NVIDIA Broadcast -- filters out noise from any microphone input or speaker output

Audacity -- the best sound editor and free 

Peace and EqualizerAPO -- a genuine equalizer for Windows

Video

NVIDIA Broadcast -- it will take background out of videos, blur them, replace them... 

Handbrake or Format Factory -- convert video (or audio) from one format to another

VLC Player or any other Media Player alternative -- playback most formats, online or off

DisplayFusion (freemium) -- manages multiple monitors with ease, task bar, wallpaper, and more

Davinci Resolve Free (paid available) or Shotcut or CapCut (freemium) -- video editor, CapCut is probably easiest but some functions locked away under freemium, ShotCut is a bit more professional, and Davinci Resolve is super powerful but complicated.

Clipboard

Clipboard Fusion -- hotkeys, transforms, triggers, sync, history... make your clipboard useful!

Desktop Customization

Wallpaper Engine (paid) -- live wallpaper that covers multiple monitors, that truly interact with you, playlists, support PC RGB lighting engine sync... 

Fences (freemium) -- automatically organize your desktop shortcuts and icons into groups, have them fade or vanish when not in use

Rainmeter -- customizable skin / widget you can place on your desktop

Launcher / File Manager / Explorer Alternative

Launchy  -- hit a hotkey to bring up a program launch bar by typing in partial name, no need to hunt in Windows desktop or start menu, supports skins. NOTE: Windows PowerToys have something similar, 

Double Commander -- a clone of the old Norton Commander                  

Text Expander

PhraseExpress or AutoHotKey

Define short phrases, and these programs will expand them into full sentences as you type them. AutoHotKey will also give you macro capability with your regular keyboard 

Mobile Link

Microsoft Phone Link -- Link your Android or iOS smartphone to your PC via Bluetooth and companion app, and get phone notifications on the PC, answer phone calls on PC, do SMS, etc. 

Offline Reader

Omnivore -- a free offline reader that also gives you FREE email addresses that you can cut off to kill off spam that won't let you unsubscribe. So your "mailing list" goes into your offline reader instead of your inbox. 

Office Suite

LibreOffice -- or any other similar suite such as OpenOffice, PolarisOffice, OnlyOffice, WPS Office, SoftMaker Office, and too many others to list. 

Zettlr -- think of it as a MUCH simplified version of Obsidian.md, it's all markdown files, and little else. 

Notepad++ -- it's just a much better notepad, but there are many other alternative text editors

Miscellaneous

WizFile -- search for any file on your HD(s) with very fast filtering (you can also try Everything)

WizTree -- display your HD's usage per folder... also very fast

Revo Uninstaller (freemium) -- Uninstaller, everybody needs one, the built-in is not good

And Microsoft PowerToys... 

Well, that's most of what I use. I hope you find something useful in here. 

App Discovery: PEACE and EqualizerAPO for Windows -- what Microsoft should have included

Photo by David James on Unsplash

When you think about it, the sound system in Windows is extremely primitive. It doesn't even have treble/bass, much less an equalizer! 

That's where the free EqualizerAPO comes in. Yes, it's free. Yes, it works in almost ALL versions of Windows, including latest Win11. 

However, EqualizerAPO doesn't have a graphical interface, which is where PEACE comes in. This gives you EQ presets, hotkeys, and more so you can switch setup on the fly. 

Install EqualizerAPO first, then PEACE. 

Now enjoy your Windows audio PROPERLY.