Is Windows Lite Microsoft’s Answer to Google’s Chrome OS?

Microsoft is working on a new operating system — Lite — with a different look that’s designed for the casual computer user while targeting Google’s Chrome OS  

Windows Lite is the oft-rumored, highly anticipated stripped-down operating system that Microsoft is reportedly working and could be unveiled sometime in the spring of 2019. What exactly is Windows Lite and why is Microsoft investing in it?

What Is Windows Lite?

Rumors began to surface in late 2018 that Microsoft was working on a new version of its Windows 10 operating system. While details have spotty at best, it appears that Windows Lite is intended to be Microsoft’s latest attempt to compete with Google’s Chrome OS, the driver of its popular Chromebook product line.

Windows Lite reportedly will be faster and leaner than other Windows operating systems. In fact, some reports indicate that the new operating system will be so different from other Windows products that Microsoft may remove the “Windows” name from it altogether.

How Will Windows Lite Work?

The new operating system reportedly will only run apps from the Universal Windows Platform (UWP) downloaded from the Microsoft store. It will also allow progressive web apps, which are applications that are run through an online service but operate like an offline app. Microsoft is exploring whether Lite will eventually be able to support Win32 apps as well.

Windows Lite will also be instantly on and always connected. It will be designed to work with multiple CPUs, providing flexible options for device manufacturers and consumers.

The focus is on building a product that emphasizes simple interactions and maintenance.

It’s expected that Windows Lite will not be available directly to consumers but rather to OEMs as a way to offer an alternative to the increasingly popular Chromebook. Instead, it will come pre-installed on laptops marketed to the home user and students.

The product is designed for users who only need “light” computing without the power, complexity and strength of traditional Windows operating systems. For users who need to write an essay, chat with friends or listen to music, Windows 10 is a bit of overkill.

Will It Look Like Windows?

The Lite OS will likely look very little like Windows. The interface is expected to be cleaner and more modern. The Start button is in the middle of the screen, for example. The search box is reminiscent of Chrome OS, with suggested and pinned applications listed prominently.

That said, there are some familiar components. File Explorer is still there and foundational components like Settings are present at this time.

The divergence from Windows is why some believe that Microsoft will remove the Windows branding entirely from the new product. Why would Microsoft intentionally move away from the established, decades-long Windows brand?

For one, ‘Windows’ carries with it certain expectations about functionality and capabilities. Microsoft may well want to begin reshaping how people think about what an operating system is, what it looks like and its user interface. It could be the beginning of a new direction for the company.

It could also be a way to circumvent the notion that Windows is too complex, complicated or fully featured, attracting those who have sworn off Windows operating systems in the past.

When Will Windows Lite Be Available?

There has been no official announcement or scheduled release date published. Given that hints about the new operating system are beginning to appear in Windows Insider builds, it’s likely that Microsoft is quite far along in its development. One possible target for an unveiling would be at the Microsoft Build 2019 conference in May 2019. Wider testing could begin this summer.

Chrome Will Offer More Ways To Control Web Tracking

Google announced a pair of important security features of upcoming versions of its Chrome browser at this year’s I/O Developer Conference.

Both changes are designed with the same goal in mind:

To give users some additional tools to block or at least mitigate the threat of online tracking.

The first of the two new features is called Improved SameSite Cookies, and as the name suggests, it’s an attempt to improve cookie handling.  As you probably know, cookies are created when a user visits a particular website.  Cookies are the mechanism by which that site remembers information about a user’s visit. It stores information such as preferred language, items you may have in your shopping cart (if the site has an eCommerce element), your login information, and the like.

Unfortunately, cookies are often used to identify users and track their movement and activities. That is not only by the owners of the site, but also by any third-party the site shares data with.  As an example, cookies are the reason that re-targeting ad strategies work. Worse, there’s currently no good way to categorize and identify how websites are using cookies.  To every browser in use today, they’re all considered to be the same thing. That is why when you go into your browser settings page and clear your cookies, it automatically logs you out of all websites where you’ve saved your login credentials.

Google’s new feature would change that, allowing you to selectively delete cookies based on what they’re doing. That means you’d be able to preserve your saved logins while blocking or deleting cookies used for other purposes. In a similar vein, the company’s planned Fingerprinting Protection feature seeks to make it harder to fingerprint people that are using the Chrome browser. That is a tactic commonly used to track user activity without their knowledge and consent.

It remains to be seen how robust these new features will be, but if they live up to expectations, they’ll be two powerful new additions to Google’s growing suite of user controls.  That’s a very good thing.

How to Protect Yourself from Cryptojacking

Hackers use cryptojacking to mine cryptocurrencies, and this process can cause PCs to run below optimal speeds.  If you have a relatively new computer but are experiencing performance problems after clicking a link or visiting a website, you might be a victim of cryptojacking. Here’s what to do.

Hijacked hardware

Instead of paying for computing power themselves, hackers opt to secretly use thousands of compromised computers to generate cryptocurrency. They gain control of a victim’s PC by using phishing emails to lure them into clicking on a link, which then runs malicious cryptomining programs on the computer. Any cryptocurrency produced then gets delivered to the hackers’ private server.

But wait, there’s a more insidious tactic hackers use: infecting websites with ads and plugins that run cryptojacking code. By doing so, any visitor who loads the web page instantly gets infected with the malware, which sends their computer’s processor into overdrive as it tries to generate cryptocurrency.

If there’s a silver lining here, it’s that cryptojacking software won’t compromise your data unlike most malware do. However, it will hijack your hardware’s processing power, so you’ll experience decreased PC performance while your electricity bills increase.

Surge in cryptojacking

The biggest reason why cryptojacking is becoming so popular is that it’s a low-risk, high-reward scheme. Instead of extorting money directly from the victim, hackers can secretly generate digital currencies without the victim knowing. And even if it’s detected, it’s almost impossible to track down who initiated the attack. Moreover, since nothing was actually “stolen” (other than a portion of computing power), victims have little incentive to apprehend the culprit.

Cryptojacking is also a cheap investment. For as little as $30, anyone can purchase a cryptojacking kit from the dark web to force other computers to generate Bitcoin or Monero for them. And while it’s difficult to tell how much exactly are hackers earning by cryptojacking, we can only surmise that it’s more than the initial $30.

Because of these reasons, there’s a good chance that this type of attack will be as popular as ransomware was in 2017. According to several reports, even sites like The Pirate Bay, Openload, and OnlineVideoConverter are allegedly using cryptojacking exploits to diversify their revenue streams.

Prevention and response

Prevention is always better than cure, so include cryptojacking in your monthly security training sessions. If employees practice extra caution in dealing with unsolicited emails and suspicious links, then hackers will have no way into your systems. Using ad-blocker or anti-cryptomining extensions on web browsers is also a great way to stay protected.

Beyond prevention, network monitoring solutions should also be used to detect any unusual computer behavior. For example, if you notice a significant number of PCs running slower than usual, assume that cryptojacking is taking place. And once it’s confirmed, advise your staff to close browser tabs and update browser extensions as soon as possible.

Because cryptojacking doesn’t steal data, it may seem less threatening than some malware, but in reality, its effects are just as severe — it can incur real power, cooling, and performance costs to your business when several systems are compromised. To make sure your business stays in top form (and that you don’t end up enriching any hackers), contact us today. Our hardware solutions and cybersecurity tips will keep your business safe and sound.

Scammers Now Use Google Ads To Steal Information

There’s a new scam afoot that involves using Google Ads.

We’re frankly surprised that it’s working, but apparently, it’s drawing some unsuspecting customers in. It appears to be an organized campaign.

The unknown scam artists are creating ads with phrases like:

• “Amazon.com – Best place to get dream products. Best deals – Best support – Best price.”
• “Paypal.com – Discover how easy and safe it is to pay for goods and shop. Free Return Shipping.  180-day Refund Windows.  No funds needed.”
• “Ebay.com – Find the best selling Cell Phone Cases, Covers and Skins. Get the best deals for cell phones and smartphones.  Dream Garage Spring Event…”

These ads contain phone numbers with an invitation given to ad viewers to call them.  Of course, the numbers displayed in the ads aren’t the real support numbers for those companies. If a user should call one, he’ll be greeted by someone claiming to work for the support department of the company displayed in the ad.

Early on in the conversation, the scammer will announce some type of problem with the user’s account, and inform them that they can fix the issue, but to do so, they’ll need a code found on the back of a Google Play Store gift card.

Why this doesn’t raise an immediate red flag to users is a mystery. Apparently some users are handing over the information if they have a gift card, which the scammers promptly make use of. For Google’s part, they are working to remove the ads but it’s a bit like playing Whack-A-Mole.  For every one they identify and take down, a new one seems to appear.

In any case, the company did issue an official statement which reads as follows:

“We have strict policies that govern the kinds of ads we allow on our platform, and ads that conceal or misstate information about their business are prohibited on our platform.  When we find ads that violate our policies, we remove them.”

Recent Data Breach May Affect Hotmail And Outlook Users

Microsoft recently confirmed that the login credentials of one of its customer support agents was compromised.

This allows unknown third parties to log in and gain access to data contained in an unspecified number of users’ Hotmail and Outlook email accounts. The exposure occurred between January 1 and March 28 of this year (2019).

When news of the breach first emerged, the company issued a statement that read, in part, as follows:

“We have identified that a Microsoft support agent’s credentials were compromised, enabling individuals outside Microsoft to access information within your Microsoft email account. This unauthorized access could have allowed unauthorized parties to access and/or view information related to your email account (such as your email address, folder names, the subject lines of emails, and the names of other email addresses you communicate with), but not the content of any emails or attachments…it is important to note that your login credentials were not directly impacted by this incident.”

In our view, the last line is the most important in the formal statement.  The hackers were able to glean some information from an unknown number of accounts, but they did so by proxy through the lens of a compromised support account, and not by stealing actual login credentials of users.

Since the company’s announcement, there have been conflicting reports that suggest the breach may have been more serious than Microsoft is currently claiming.  As such, our recommendation is that if you have a Hotmail or an Outlook.com account, the best course of action would be to exercise an abundance of caution and change your password right away.  It’s far better to be safe than sorry.

Also be aware that since hackers may have gleaned your email address as a result of their snooping, you are somewhat more likely to be on the receiving end of phishing emails in the weeks and months ahead.  Be on your guard against that.

Get the “FAQ’s” On Two-Factor Authentication

Data security has to be a core consideration of the modern business, so every small effort you can take to protect your business is important. One such effort is the implementation of two-factor authentication. However, your employees may not initially feel entirely comfortable with some facets of two-factor authentication.

The two-factor authentication platform, adds a valuable layer of security to your existing solutions by requiring an additional credential beyond just your typical username and password. This can be a PIN that is generated by an application or even a physical token like a key fob that provides access.

To make a long story short, your employees may not feel entirely comfortable with your organization requiring them to keep an application on their phone as they may value the autonomy they have over what they do and don’t keep on their personal device. As a result, they are bound to have questions that you will need to answer.

To assist you with this, we’ve compiled a few questions you may have to field, and how to answer them truthfully and diplomatically if you choose to implement two-factor authentication for your business.

What is it?
Two-factor authentication is another way to improve data security and prevent threats from infiltrating business network’s access points. Picture your network as a house that your data lives in, with the front door being the access point. The lock that you find in the doorknob is your usual access credentials, username and password. 2FA adds a deadbolt to that door.

In other words, 2FA is the added security that can keep many threats out, at the cost of a tiny bit of convenience.

Why do I have to do this?
This line of questioning is indicative that an employee is resistant to change–unfortunately, information technology is built on change. Threats to a business’ security are always improving so they have the best chance of creating the most impact. To counter this, a business must acknowledge the risks inherent in powerful technology platforms and do everything they can to control access to their network. 2FA is just one of many ways to do that.

It is also important to remember that a chain is only as strong as its weakest link, so the entire business could be made vulnerable if one person doesn’t have the same dedication to organizational network security as the rest of the team. By implementing 2FA as a team, the business is better protected by the team.

Why do I have to do it on my personal phone?
This answer has two parts to it, one being of best interest to the business, the other being for the employee’s benefit. First off, economics. Does your business have the capital to spare to distribute mobile devices for the singular purpose of enacting 2FA? Typically, this isn’t the case.

Furthermore, which device is an employee more likely to favor? Their personal device that they have conditioned themselves into bringing everywhere, or the new, unfamiliar device they were just given for work?

What happens if I lose or forget my phone?
There are ways to get around a forgotten or misplaced device. In many cases, an organization can adjust an employee’s 2FA settings to allow them access via a new 2FA code, but this will require the employee to change their credentials. If the phone is lost, the company is still safe, as the Mobile Device Management platform that the 2FA implementation was likely part of will allow network administrators the requisite authority to handle the situation.

Can you see my personal stuff?
This question will likely come up. You should ensure your employees that the privacy of their personal data will not be betrayed, and that the authenticator will only be used to access their company materials.

Information can be a touchy subject, and its security is of paramount importance. Reach out to us at Net Activity for more help with your company’s data security.