Security Firm Exposes Details About $15,000 Box That Can Unlock Any iPhone

When the FBI asked Apple to create a backdoor into iOS in the wake of the San Bernardino shooting, Tim Cook and co. basically told the government to screw off. That’s because if Apple created special methods of bypassing its own safety measures, the company argued it would be putting every iOS user at risk.

This forced the government to turn to hackers and third-party security firms like Cellebrite, which earlier this year claimed it could unlock all of Apple’s latest iOS devices. But now, there’s apparently a new iPhone unlocking tool on the market that could rival the $5,000-per-device unlocking service offered by Cellebrite.

According to info released to security software company Malwarebytes, the GrayKey is a proprietary hardware solution about the same size as an Apple TV that can crack an iPhone’s unlock code in a little as two hours, though it can take three days or more for longer, six-digit passcodes. You can view a picture of the device here.

Developed by Grayshift, a private security firm founded in Atlanta in 2016, the GrayKey seems to be available in two different configurations: a $15,000 model that requires a geo-fenced internet connection to function, and an unlocked $30,000 version that works offline and can be used an unlimited number of times.

Once the GrayKey cracks an iPhone’s passcode, the box can be used to download the entire contents of a device or analyze and decrypt the device’s keychain, according to Malwarebytes. In photos shared with Malwarebytes, there seems to be evidence of a successful unlock attempt in which the GrayKey discovered the passcode of an iPhone running iOS 11.2.5, which indicates this happened relatively recently, as the most up-to-date release of iOS is version 11.2.6.

Even without your consent, the GrayKey could allow the government to access your phone in very little time. And if the device fell into the hands of a thief, it could make the process of flipping stolen iPhones trivial. With all that said, Apple’s next update to iOS could fix whatever vulnerabilities the GrayKey apparently uses to crack passcodes.

National Password Day

When is the last time you reviewed the passwords to your bank account, e-mail or credit card accounts?

Today is a good day to do it. Why? It’s National Password Day.Today, we are sharing tips to make your passwords more secure.

• Make your password long, strong and complex.That means at least twelve characters, mixed with uppercase and lowercase letters, numbers, and symbols. Avoid common words, phrases or information in your passwords.
• Don’t reuse passwords used on other accounts.Use different passwords for different accounts so that if a hacker compromises one account, he can’t access other accounts.
• Use multi-factor authentication, when available. For accounts that support it, two-factor authentication requires both your password and an additional piece of information to log in. The second piece could be a code sent to your phone, or a random number generated by an app or token. This protects your account even if your password is compromised.
• Consider a password manager. Most people have trouble keeping track of all their passwords. Consider storing your passwords and security questions in a reputable password manager, an easy-to-access application that stores all your password information. Use a strong password to secure the information in your password manager.
• Select security questions only you know the answer to. Many security questions ask for answers to information available in public records or online, like your zip code, mother’s maiden name, and birth place. That is information a motivated attacker can obtain. Don’t use questions with a limited number of responses that attackers can easily guess – like the color of your first car.
• Change passwords quickly if there is a breach. If you receive a notification from a company about a possible breach, change that password and any account that uses a similar password immediately.

7 Rules Your Teens Should Follow While Online Dating

Parenting teens and young adults in the online age can be daunting, especially with the prevalence of online dating. While your teen could meet the love of their life on dating apps, young people can also put themselves in unsafe situations online.

With these seven tips, though, you can rest easy knowing you’ve prepared your children for the high-stakes world of online dating.

Keep Your Identity Safe

This tip may seem like a no-brainer, but scammers can be creative and convincing as they try to steal your identity. Teach your kids to never send their Social Security numbers, bank information or any usernames and passwords to anyone they’ve met online. Never send money for any reason, even if the person claims it’s an emergency.

Your children should also keep full names, birthdates, addresses and other personal information private until they feel they know and trust the people they’re talking to.

Be Safe on Social Media

Some major dating apps connect through Facebook and display some of your public information to potential matches. Limit this shared information by updating your Facebook – and other social accounts’ – privacy settings and keeping as little information public as possible. If your children feel uncomfortable having a dating app linked to their Facebook, they can try a different app that allows them to sign in without connecting their account.

Get to Know Your Match Before Meeting in Person

Young adults should be certain they aren’t being catfished before meeting up with anyone they’ve met on a dating app or site. They should message their interest on the app for a while before meeting up for a date, and if they feel like something is off, they shouldn’t meet up with their online interest.

Video chatting is also a good way to see that the person they’re talking to is who they say they are. If someone refuses to Skype or FaceTime, they could be hiding something – even if they have a clever excuse.

Do a Background Check

If young daters have in friends in common with an online interest, they can reach out and ask if the person is trustworthy. They can reverse-search the pictures they have on the app as well using a search engine; if the search pulls up images connected to different social media accounts, the pictures were likely stolen from someone else.

Go on Safe Dates

Be sure the date happens during daylight hours and in a public place – your children shouldn’t invite a date to your home, and they shouldn’t go to their dates’ houses at first. Kids should also tell friends or family where they’ll be and always have an exit strategy just in case. They also shouldn’t accept rides from matches until they know and trust them and should always drive themselves and meet up at the location. There’s safety in numbers, so consider suggesting a double or group date.

Trust Your Friends and Family

If you or your kids’ friends say a match is sketchy, your children should at least listen to the advice. Those who are removed from the situation may have a clearer view and opinion of a potential date, while your children might be too blinded by excitement to see any possible warning signs.

Trust Your Gut

If something feels off, it probably is. Your children are under no obligation to meet anyone they’ve met on a dating app or site, even if matches are persistent or get upset if your kids say no to a date. If your child is asked on a date with which they don’t feel comfortable, they should suggest something else and be honest with their concerns. Any reasonable and trustworthy person will understand.

Consider having an emergency word your kids can text or say to you or a friend if they’re ever in an unsafe or uncomfortable situation and need help.

The most important thing you can do as a parent is create an open dialogue with your children about online safety. Do everything in your power to make sure your teen or young adult knows they can talk to you about online dating.

YouTube TV Review: The New Cord-Cutting Bundle

YouTube TV is finally available to the vast majority of U.S. residents, and it was worth the wait.

The $40-per-month streaming bundle is only available in markets where YouTube TV can carry at least three live local broadcast channels, but that now covers about 85 percent of U.S. households. And in February, the YouTube TV app landed on Roku and Apple TV, joining existing apps for Android TV, Xbox One, Chromecast, Android, and iOS.

Even though YouTube TV is pricier than it used to be, it’s still an excellent value, covering many of the most popular news, sports, and entertainment channels on television. It’s also the best attempt yet at combining live, on-demand, and recorded TV into a comprehensible interface. For most people—save for the unfortunate 15 percent who still can’t get it—YouTube TV is the best all-around streaming TV bundle.

YouTube TV: What you get

YouTube TV is a one-size-fits-all service, with more than 50 channels for $40 per month. The lineup includes the major broadcast networks, ESPN channels, regional sports from Fox and Comcast, all three major cable news networks, and a slew of entertainment channels such as FX, AMC, SyFy, and Disney Junior. Access to YouTube Red originals are included at no extra charge, and you can add Showtime for $11 per month and Fox Soccer Plus for $15 per month. (See the bottom of this review for the full channel list.)

Like other streaming bundles, YouTube TV omits some networks to keep prices down. You won’t get any channels from Scripps Networks (HGTV, Food Network), Discovery Communications (Animal Planet, Science), or Viacom (Comedy Central, MTV), and the package doesn’t include the NFL Network. Google is also a bit less stringent about including local channels than it was at launch, when it offered live feeds from ABC, CBS, NBC, and Fox in five markets. Now, some markets only include live local broadcasts from three of those channels—plus the CW in some cases—with on-demand video from the rest.

Each subscription entitles you to three simultaneous streams, and supports up to six profiles for anyone with a Google account, allowing family members to save their own favorite shows and DVR recordings (more on that shortly). YouTube TV also works with about 20 TV Everywhere apps, so you can log in and watch shows even on platforms that the service doesn’t support yet.

How YouTube TV DVR works

YouTube TV doesn’t charge extra for DVR, like Sling TV does, nor does it set storage limits like Sling TV, Hulu, and FuboTV do. Instead, recordings expire after nine months, which is more generous than the 28- and 30-day windows afforded by PlayStation Vue and Philo respectively. The service also supports partial recordings, and it lets you watch the recorded portion of a program while it’s still airing live. You can pause any live TV channel and rewind through what you’ve already watched as well.

YouTube TV replaces recordings with on-demand streams if the latter are available, and the on-demand versions don’t allow ad-skipping. In some cases, you can expect to sit through about a minute and 30 seconds of ads for each commercial break, which tends to line up with the breaks in the live telecast. An option to pay extra for longer than nine months of storage and full ad-skipping privileges would be appreciated.

Some DVR users might gripe about the lack of granular controls—you can’t make one-off recordings or avoid recording reruns—but having unlimited storage means you shouldn’t have to worry about recording management in the first place. The only thing that’s really missing is a way to filter unwatched recordings.

Here’s the full YouTube TV channel list as of February 19, 2018:

• ABC
• AMC
• BBC America
• BBC World News
• Big Ten Network
• Bravo
• Cartoon Network / Adult Swim
• CBS
• CBS Sports Network
• Cheddar
• CNBC
• CNN
• CW
• Disney Channel
• Disney Junior
• Disney XD
• E!
• ESPN
• ESPN-SEC Network
• ESPN2
• ESPNU
• Fox
• Fox Business
• Fox News
• Fox Sports regionals
• Freeform
• FS1
• FS2
• FX
• FXM
• FXX
• Golf Channel
• HLN
• IFC
• Local Now
• MSNBC
• Nat Geo Wild
• National Geographic
• NBC
• NBC Sports regionals
• NBCSN
• NESN Regional
• Olympic Channel
• Oxygen Network
• Sundance TV
• Syfy
• TBS
• Telemundo
• TNT
• TruTV
• Turner Classic Movies
• Universal Kids
• USA Network
• We TV
• Showtime ($11/mo extra)
• Fox Soccer Plus ($15/mo extra)

Watch Out For These New Tax Scams

They’re at it again... tax scammers scheming new ways to steal personal information and money.

In the first scenario, identity thieves file a fake tax return and have the refund deposited into your bank account. The thieves then contact you, often by phone, and — posing as the IRS or debt collectors for the IRS — demand you return the money to the IRS. But following the thieves’ instructions actually sends the money to them.

In another version, after you get that erroneous refund, you get an automated call, allegedly from the IRS, threatening you with criminal fraud charges, an arrest warrant, and “blacklisting” of your Social Security number. The caller gives you a case number and a telephone number to call to return the refund.

Don’t take the bait. If you or someone you know gets an unexpected tax refund, follow the guidance outlined by the IRS for how to return the funds to the agency. The steps for returning paper checks and direct deposits differ.

In a different scam, criminals are using imposter tax preparation sites and phone numbers to steal peoples’ personal information. Here's how this scam works: You go online to find a tax preparation service to prepare and e-file your tax return. But instead of landing on a legitimate site, you mis-click to a look-alike site created by scammers. The site looks real, and it’s set up to collect personal information that can be used to commit fraud, including identity theft.

Here are some great tips to fight tax identity theft:

• File your tax return early in the tax season, if you can.
• Use a secure internet connection if you file electronically, or mail your tax return directly from the post office.
• When using an online tax preparation service, look for the tax preparer identification number. The IRS requires all paid tax preparers to have one before filing any returns.
• To determine if a website is encrypted, look for https at the start of the web address (the “s” is for secure). Some websites use encryption only on the sign-in page, but if any part of your session isn’t encrypted, your entire account could be vulnerable. Look for https on every page you visit, not just when you sign in.
• Ask tax preparers about their data security policies, and how they protect your information.
• Respond to all mail from the IRS as soon as possible.
• If tax identity theft happens to you, visit IdentityTheft.gov to report it to the FTC, file an Identity Theft Affidavit with the IRS electronically, and get a personal recovery plan.

If you spot a scam, report it at ftc.gov/complaint. Your reports help the FTC and other law enforcement investigate scams and bring crooks to justice.