Connect with us

Published

on

Over the years, travelers have repeatedly been warned to avoid public Wi-Fi in places like airports and coffee shops. Airport Wi-Fi, in particular, is known to be a hacker honeypot, due to what is typically relatively lax security. But even though many people know they should stay away from free Wi-Fi, it proves as irresistible to travelers as it is to hackers, who are now updating an old cybercrime tactic to take advantage.

An arrest in Australia over the summer set off alarm bells in the United States that cybercriminals are finding new ways to profit from what are called “evil twin” attacks. Also classified within a type of cybercrime called “Man in the Middle” attacks, evil twinning occurs when a hacker or hacking group sets up a fake Wi-Fi network, most often in public settings where many users can be expected to connect.

In this instance, an Australian man was charged with conducting a Wi-Fi attack on domestic flights and airports in Perth, Melbourne, and Adelaide. He allegedly set up a fake Wi-Fi network to steal email or social media credentials.

“As the general population becomes more accustomed to free Wi-Fi everywhere, you can expect evil twinning attacks to become more common,” said Matt Radolec, vice president of incident response and cloud operations at data security firm Varonis, adding that no one reads the terms and conditions or checks the URLs on free Wi-Fi.

“It’s almost a game to see how fast you can click “accept” and then ‘sign in’ or ‘connect.’ This is the ploy, especially when visiting a new location; a user might not even know what a legitimate site should look like when presented with a fake site,” Radolec said.

Today’s ‘evil twins’ can more easily hide

One of the dangers of today’s twinning attacks is that the technology is much easier to disguise. An evil twin can be a tiny device and can be tucked behind a display in a coffee shop, and the small device can have a significant impact.

“A device like this can serve up a compelling copy of a valid login page, which could invite unwary device users to enter their username and password, which would then be collected for future exploitation,” said Cincinnati-based IT consultant Brian Alcorn. 

The site doesn’t even have to actually log you in. “Once you’ve entered your information, the deed is done,” Alcorn said, adding that a harried, weary traveler probably would just think the airport Wi-Fi is having issues and not give it another thought.  

People who are not careful with passwords, such as use of pet’s names or favorite sports teams as their password for everything, are even more vulnerable to an evil twin attack. Alcorn says for individuals who reuse username and password combinations online, once the credentials are obtained they can be fed into AI, where its power can quickly give cybercriminals the key.

“You are susceptible to exploitation by someone with less than $500 in equipment and less skill than you might imagine,” Alcorn said. “The attacker just has to be motivated with basic IT skills.”

How to avoid becoming a victim of this cybercrime

When in public places, experts say it’s best to use alternatives to public WiFi networks.

“My favorite way to avoid evil twin attacks is to use your phone’s mobile hotspot if possible,” said Brian Callahan, Director of the Rensselaer Cybersecurity Collaboratory at Rensselaer Polytechnic Institute.

Users would be able to spot an attack if through a phone relying on its mobile data and sharing it via a mobile hotspot.

“You will know the name of that network since you made it, and you can put a strong password that only you know on it to connect,” Callahan said.

If a hotspot isn’t an option, a VPN can also provide some protection, Callahan said, as traffic should be encrypted to and from the VPN.

“So even if someone else can see the data, they can’t do anything about it,” he said.

Airport, airline internet security issues

At many airports, the responsibility for WiFi is outsourced and the airport itself has little if any involvement in safeguarding it. At Dallas Fort Worth International Airport, for example, Boingo is the Wi-Fi provider.

“The airport’s IT team does not have access to their systems, nor can we see usage and dashboards,” For said an airport spokesman. “The network is isolated from DAL’s systems as it is a separate standalone system with no direct connection to any of the City of Dallas’ networks or systems internally.” 

A spokeswoman for Boingo, which provides service to approximately 60 airports in North America, said it can identify rogue Wi-Fi access points through its network management. “The best way passengers can be protected is by using Passpoint, which uses encryption to automatically connect users to authenticated Wi-Fi for a safe online experience,” she said, adding that Boingo has offered Passpoint since 2012 to enhance Wi-Fi security and eliminate the risk of connecting to malicious hotspots.

Alcorn says evil twin attacks are “definitely” occurring with regularity in the United States, it’s just rare for someone to get caught because they are such stealth attacks.  And sometimes hackers use these attacks as a learning model. “Many evil twin attacks may be experimental by individuals with novice-to-intermediate skills just to see if they can do it and get away with it, even if they don’t use the collected information right away,” he said.

The surprise in Australia wasn’t the evil twinning attack itself, but the arrest.

“This incident isn’t unique, but it is unusual that the suspect was arrested,” said Aaron Walton, threat analyst at Expel, a managed services security company. “Generally, airlines are not equipped and prepared to handle or mediate hacking accusations. The typical lack of arrests and punitive action should motivate travelers to exercise caution with their own data, knowing what a tempting and usually unguarded -target it is — especially at the airport.”

In the Australian case, according to Australian Federal Police, dozens of people had their credentials stolen.

According to a press release from the AFP, “When people tried to connect their devices to the free WiFi networks, they were taken to a fake webpage requiring them to sign in using their email or social media logins. Those details were then allegedly saved to the man’s devices.”  

Once those credentials were harvested, they could be used to extract more information from the victims, including bank account information.

For hackers to be successful, they don’t have to dupe everyone. If they can persuade only a handful of people – statistically easy to do when thousands of harried and hurried people are milling around an airport – they will succeed.

“We expect WI-Fi to be everywhere. When you go to a hotel, or an airport, or a coffee shop, or even just out and about, we expect there to be Wi-Fi and often freely available WI-FI,” Callahan said. “After all, what’s yet another network name in the long list when you’re at an airport? An attacker doesn’t need everyone to connect to their evil twin, only some people who go on to put credentials into websites that can be stolen.”

The next time you’re at the airport, the only way to be 100% sure you’re safe is to bring your own Wi-Fi.

Continue Reading

Technology

Americans are holding onto devices longer than ever and it’s costing economy

Published

on

By

Americans are holding onto devices longer than ever and it's costing economy

If you are holding onto your aging printer or cracked smartphone longer than you had planned, you are not alone.

Heather Mitchell, 69, retired and living in Tucson, Arizona, is content with her phone even though it is old by smartphone standards.

“My Samsung Galaxy A71 is six-years-old. It’s hanging in there surprisingly well for a jalopy. I’ve had issues with it, and still do, but they are minor,” said Mitchell. “I love Samsung phones, but can not afford a new one right now. A new phone would be a luxury.”

The average American now holds onto their smartphone for 29 months, according to a recent survey by Reviews.org, and that cycle is getting longer. The average was around 22 months in 2016.

While squeezing as much life out of your device as possible may save money in the short run, especially amid widespread fears about the strength of the consumer and job market, it might cost the economy in the long run, especially when device hoarding occurs at the level of corporations.

Research released by the Federal Reserve last month concludes that each additional year companies delay upgrading equipment results in a productivity decline of about one-third of a percent, with investment patterns accounting for approximately 55% of productivity gaps between advanced economies. The good news: businesses in the U.S. are generally quicker to reinvest in replacing aging equipment. The Federal Reserve report shows that if European productivity had matched U.S. investment patterns starting in 2000, the productivity gap between the U.S and European economic heavyweights would have been reduced by 29 percent for the U.K., 35 percent for France, and 101% for Germany.

Experts agree lost productivity and inefficiency are the unintended consequences of people and businesses clinging to aging technology.

“Think about how much internet speeds have changed in the past decade or more. In the 2010s, 100MB speeds were considered high speed and very good. A short 10 years later and we’re operating at 1GB speeds, which is roughly 10 times faster,” said Cassandra Cummings, CEO of New Jersey-based electronics design company Thomas Instrumentation. Operating at higher GB speeds requires different electronic hardware, and a lot of the older technology can’t handle it.

“Those devices were engineered when no one could fathom speeds that much faster would be mainstream,” Cummings said.

That can be a drain on nationwide networks as well.

“Both the cellular and internet infrastructure has to operate to be backwards compatible in order to support the older, slower devices. Networks often have to throttle back their speeds in order to accommodate the slowest device,” Cummings said. “Often entire sections of networks or company internal networks are running slower than they would if all devices were up to the newer standards,” she added.

Cummings doesn’t deny that staying up to date with new devices and hardware is expensive.

“Many companies, especially small businesses, and individual people can’t afford to constantly upgrade to the latest and greatest devices,” she said.

To ease the transition to new technologies, she says there should be designs that are repairable or modular rather than the constant purge and replace cycles. “So perhaps future devices can have a partial upgrade in say ethernet communications rather than forcing someone to purchase an entirely new computer or device,” Cummings said. “I’m not a fan of the throw-away culture we have these days. It may help the economy to spend more and force upgrades, but does it really help people who are already struggling to pay bills?” she said.

Indeed, entrepreneurs in the device resale market see the longer-lived tech as a success story that can be improved upon. Steven Athwal, CEO of the UK-based The Big Phone Store — which specializes in refurbished phones — says devices longevity is not the problem. “The issue is the lag. Businesses and individuals are trying to squeeze modern workloads out of old hardware, heavy processing, rendering, generation, and admin, and that creates a productivity drag. Things like slow processors, outdated software, and degraded batteries on older tech waste energy and morale,” Athwal said.

He adds that when people hold onto their phones or laptops for five or six years, the repair and refurbishment market becomes an active part of the economy. But right now, in both European, American, and global markets, too much of that happens in the shadows.

“It’s unregulated, underreported, and underutilized. If governments and big tech supported refurbishment properly, aging devices could become part of a sustainable circular economy,” Athwal said, improving the second-hand cycle by extending software support, improving access to parts, and treating repair as infrastructure.

“That’s how you disable constant replacement. No need to constantly push upgrades, which financially strains both small and large businesses alike,” Athwal said.

Still, some device manufacturers have found ways to entice consumers to ditch their older phones for newer ones. For instance, Apple just had one of its most successful new launches with the iPhone 17, and artificial intelligence could be a game-changer.

Najiba Benabess, dean of the business school at Neumann University, says rising prices and sustainability concerns are among reasons “America’s gadgets are aging out,” but the market should be focused on slowing productivity, increasing repair and maintenance expenses, and limited access to software updates and efficiency gains.

“Small businesses, in particular, lose valuable hours each year due to lagging systems, creating what economists call a ‘productivity drag,'” Benabess said. On a national scale, this translates to billions of dollars in lost output and reduced innovation. “While keeping devices longer may seem financially or environmentally responsible, the hidden cost is a quieter erosion of economic dynamism and competitiveness,” she added.

Most people still want the newest and most up-to-date phones and tablets, according to Jason Kornweiss, senior vice president of advisory services at Diversified, a global technology solutions provider, but research does show a widening gap between businesses and individuals when it comes to aging devices.

“Corporations with hundreds or thousands of people are not investing at the same rate,” Kornweiss said, adding that technology is changing so fast IT departments can’t keep up with the pace and that bloated corporations need to vet the newest technology, which takes time, and by the time they do the vetting, something new has arrived anyway. The result: businesses with increasingly long-in-the-tooth technology.

“Businesses establish shelf-life that is multi-year. Employees look at replacing devices within an organization as too tedious and people cringe when the IT department comes with a new device,” Kornweiss said, even when it is a meaningful upgrade, he added.

The price to the organization is then paid in lack of productivity, inability to multitask and innovate, and needless, additional hours of work that stack up. Workplace research conducted by Diversified last year found that 24% of employees work late or overtime due to aging technology issues, while 88% of employees report that inadequate workplace technology stifles innovation. Kornweiss says he doesn’t expect there’s been any improvement in those numbers over the past year.

There’s a disconnect between the numbers and behavior. Many workers report that aging devices stifle productivity, but like a favorite pair of shoes or an old sweater, they don’t want to give them up to learn the intricacies of a new device (which they’ll learn and then have to replace with another). Familiarity can trump productivity for many workers. But the result of that IT clinginess is felt in the bottom line.

“Productivity is hampered and it all has a tangible impact on the economics,” Kornweiss said.

The biggest commodity a worker has is time, he says, and older devices gobble that up. Bring-your-own-device (BYOD) policies can be a savior for businesses slow to upgrade, with individuals using their own more functional devices easily able to integrate into most workplace systems these days, Kornweiss said. Another option for companies that don’t want to buy a bunch of quickly dated devices is to lease.

Kornweiss sees a future where technology continues to advance at warp speed and companies will continue to have trouble keeping up. And individuals like Heather Mitchell will continue to hang on to their devices.

“I tend to hang onto my phone until I have no choice in the matter. In 26 years, this is only my fifth phone,” Mitchell said.

Continue Reading

Technology

More companies are shifting workers to passwordless authentication

Published

on

By

More companies are shifting workers to passwordless authentication

It’s safe to say that no one is crazy about passwords. For chief information security officers, there’s the nightmare of employees leaving lists of passwords on their desks or putting them on Post-it notes on their computers. For workers, there’s the inconvenience of having to enter multiple passwords to gain access to various devices and resources.

Passwordless authentication technology is designed to address these issues, and use of these tools is on the rise. A recent survey of 200 CISOs by Wakefield Research, sponsored by security vendor Portnox, showed that a significant majority (92%) of the security leaders said their organizations had implemented or were planning to implement passwordless authentication. That’s up from 70% in 2024. CISOs cited improved employee productivity and enhanced user experience as the top benefits.

Passwordless authentication verifies user identity without the need for traditional passwords, through alternative methods such as hardware tokens, biometrics, or mobile push notifications. It offers potential benefits such as enhanced security and improved user experience.

Training services provider Universal Technical Institute has begun using a passwordless platform from Microsoft, “and as we expand adoption, the benefits show up quickly, with fewer password resets, fewer service desk tickets, and a faster start to the day,” said Adrienne DeTray, senior vice president and CIO at the company.

“The bigger impact is cultural,” DeTray said. “It shows that we’re serious about making technology feel lighter and more human again. Over the years, we’ve added so many systems and logins that the weight of technology has become part of the work. This is one of those steps that helps remove that administrative drag and makes the ecosystem feel more seamless and connected.”

It’s not just about security, DeTray said, but user experience as well. “Every password reset or lockout slows people down and chips away at their focus,” she said. “Passwordless takes that friction out of the day and gives people time back. It’s part of designing a connected ecosystem where security and usability work hand in hand.”

MFA losing status as ‘gold standard’ cybersecurity

R Systems International, a provider of digital product engineering services, is in the midst of a phased migration to a passwordless environment, said CTO Srikara Rao. “For us, this isn’t about chasing a trend, it’s a direct response to the fact that our previous gold standard, multi-factor authentication, is showing its age,” Rao said. “The threat landscape has evolved past what traditional MFA can handle.”

R Systems’ decision to make the move is driven by both security and business enablement factors. “Credential-based attacks remain the top threat vector, with a significant rise in phishing attempts and several near-miss incidents underscoring the urgency to act,” Rao said. “We want to promote solutions within our organization that are phishing resistant.”

On the operational side, password resets have become quite expensive, Rao said. Resets can be costly due to direct labor expenses and significant indirect costs such as lost employee productivity and IT resource drain. Research firm Forrester estimates that a single password reset can cost $70, and this can add up quickly for large enterprises.

In addition, it’s critical that the company adhere to compliance requirements such as PCI 4.0, which mandates that users reauthenticate everything they restart or access. “Passwordless authentication will make it seamless,” Rao said. “And finally, as we compete for top tech and cybersecurity talent, being a passwordless enterprise signals that we’re a forward-thinking, security-first organization.”

Bring-your-own-device policies are a factor

Health-care services provider Diversus Health is also moving to passwordless authentication, using the technology in the form of certificate-based network access control.

“Due to recently adopting a bring-your-own-device policy, our internal annual HIPAA compliance audit detected lack of network access control as one of our high-risk threats,” said Neil Ford, IT security administrator. “So, we began looking into solutions that could be used to mitigate the threat.”

Diversus Health earlier this year deployed a system from Portnox that uses certificate-based authentication to verify the identity of devices. “We deploy the certificate through a cloud-based endpoint management solution, so verification with Portnox is transparent to staff,” Ford said.

The solution has effectively mitigated the threat of unknown devices connecting to the company’s network and being able to access internal resources, Ford said.

One of the keys to a successful adoption of passwordless authentication is to effectively communicate the security change with staffers. “Employees are overcoming decades of password muscle memory and addressing legitimate user anxiety about ‘what if I lose my device?’ is critical,” Rao said. “We learned quickly that we had to sell the ‘why’ to our employees.”

Enterprises need to frame passwordless authentication not as another security mandate, but as a direct benefit to employees through less frustration, faster logins, and the elimination of password resets, Rao said. Before making the shift, R Systems ran small, interactive training sessions to get people comfortable with access tools such as fingerprint identification on their phones.

“I cannot stress enough the importance of organizations providing user education,” Rao. “It’s a significant difference between a successful deployment and a shelfware investment.”

R Systems passwordless strategy isn’t tied to a single vendor, but built on FIDO2 and WebAuthn open standards, “giving us flexibility to choose the right tool for each risk profile,” Rao said. “Privileged users such as administrators, developers, and executives use FIDO2 hardware security keys, while the broader workforce relies on passkeys integrated with device biometrics like Windows Hello and Face ID.”

The company is still evaluating the results of the transition to passwordless authentication and working to ensure that it works best for everyone.

“We’ve seen our employee experience improve dramatically, with faster logins and a significant reduction in password-related help desk tickets,” Rao said. “Most importantly, passwordless authentication has become a cornerstone of our zero-trust architecture, giving us a stronger, high-assurance identity layer that enables secure access regardless of user or device location.”

Continue Reading

Technology

Microsoft faces uphill climb to turn enterprise dominance into widespread AI chatbot adoption

Published

on

By

Microsoft faces uphill climb to turn enterprise dominance into widespread AI chatbot adoption

Microsoft CEO Satya Nadella speaks at Microsoft Build AI Day in Jakarta, Indonesia, on April 30, 2024.

Adek Berry | AFP | Getty Images

On Microsoft’s earnings call last month, CEO Satya Nadella boasted about the company’s artificial intelligence products, and said over 150 million people are using its Copilot assistant for productivity, cybersecurity, coding and other endeavors.

But conversations with IT buyers at Microsoft’s Ignite conference in San Francisco this week highlighted some of the hurdles the company must overcome as it tries to sell its AI chatbot in the enterprise market.

“I know a lot of customers who are like, ‘Yeah, I want 300 to go to zero,'” said Adam Mansfield of consulting firm UpperEdge, referring to Copilot licenses. Mansfield, who helps companies negotiate Microsoft deals, said those clients are saying, “I don’t even want it.”

Microsoft started selling the commercial version of 365 Copilot two years ago for $30 per person per month, as an add-on to its broader productivity suite. The chatbot can answer a user’s questions based on information stored in corporate systems and can run alongside Microsoft apps, summarizing email threads, creating formatted presentations and capturing key points from calls.

Microsoft is competing in AI on multiple fronts, with its heftiest investment coming out of its Azure cloud infrastructure business. Alongside a $13 billion bet on OpenAI, Microsoft is the AI startup’s key cloud provider. In October OpenAI announced a $250 billion commitment.

Microsoft said revenue growth at Azure reached 40% in the latest quarter, topping the growth rate at Amazon Web Services and Google’s cloud business.

AI agents present a different challenge. Instead of paying for the infrastructure needed to run hefty workloads, customers are buying a new tool for their employees, and the return on that investment isn’t yet clear, according to a number of clients and consultants interviewed by CNBC.

Google's AI momentum begins to worry OpenAI's Sam Altman

Adobe, Google, Salesforce, Workday and other vendors are also trying to sell agents to corporations, schools and governments, creating a crowded market for a still nascent technology. OpenAI and Anthropic not only have popular AI models but are increasingly catering to businesses with new services as well.

Eon, a Sequoia-backed cloud backup startup, runs its software in Azure. CEO Ofir Ehrlich said MIcrosoft has broadened Azure’s appeal for software developers and operations specialists. But the company isn’t standardizing on Microsoft’s AI software. It relies on AI coding tools from startups Cognition and Cursor and multiple AI assistants, said Ehrlich, who previously sold startup CloudEndure to Amazon.

Google’s Gemini has been making rapid advancements in the market. This week, the company debuted its latest model, Gemini 3, which it says will deliver better answers to more complex questions.

“We just had a massive 16,000-employee company move all their mail to back to Google so they can leverage more Gemini,” said Julian Hamood, founder of Microsoft partner TrustedTech.

Microsoft declined to comment.

More discounts?

Land O’Lakes butter is displayed in a supermarket in New York on Feb. 15, 2017.

Brendan Mcdermid | Reuters

This year, butter maker Land O’Lakes rolled out Microsoft 365 Copilot to all of its nearly 5,000 knowledge workers, after initially granting access to about 20% of them. A small number of employees also have Gemini subscriptions.

Land O’Lakes has long relied on Microsoft software and now runs over 70% of its infrastructure in Azure, said Teddy Bekele, the company’s technology chief, in an interview at Ignite.

Software engineers at Land O’Lakes relied on the GitHub Copilot AI automated programming software to build custom project and portfolio management software, Bekele said, adding that the company stopped paying for an off-the-shelf product.

Now Land O’Lakes is testing Oz, an assistant for retail agronomists who advise farmers. The company developed it with Microsoft Foundry software. Oz can save Land O’Lakes money as it replaces older applications, Bekele said.

‘Natural choice’

Education publisher Pearson, meanwhile, has turned on Microsoft 365 Copilot for all of its 18,000 employees. The company uses Windows, Office and Azure products, as well as Amazon and Google cloud services, technology chief Dave Treat said at the conference.

At Ignite, Pearson announced Communication Coach, an agent that will provide personalized learning recommendations through Copilot based on Teams calls, with help from OpenAI’s GPT-4o mini model.

“Microsoft is dominant in the enterprise,” Treat said. “It was a natural choice if we’re thinking about how to train people in communication in the workplace.”

Microsoft is also adding more models into the fold. On Tuesday, Microsoft said Anthropic is bringing its Claude Haiku 4.5, Opus 4.1 and Sonnet 4.5 to Microsoft Foundry. Anthropic committed to spend $30 billion on Azure.

“Before today, we didn’t have access to all the models from Anthropic,” Treat said. “Now we do. That’s a big improvement.”

Still, Mansfield said competition has intensified this year, and some companies have been more seriously evaluating alternatives to Microsoft’s AI products.

“Microsoft is trying to catch up, quite honestly,” Mansfield said. “That’s not what a monopoly typically has to do. They’re not comfortable. Their sales reps actually now have to learn to sell.”

According to Microsoft, the technology is getting more traction internally.

Around 70% of commercial sales, support and partner services workers now use Microsoft 365 Copilot daily, up from 20% a year ago, said Pam Maynard, the company’s chief AI transformation officer.

“We’ve got the 30% daily active usage to get after,” Maynard said in an interview. “I do believe we’ll get there, and it’s just part of change management and helping people to develop that habit.”

WATCH: Microsoft CEO of commercial business on Anthropic, Nvidia partnership

Microsoft CEO of commercial business on Anthropic, Nvidia partnership

Continue Reading

Trending