Year: 2018

Ralph Nadar (remember him?) writes open letter to Apple’s CEO

Dan Uff May 12, 2018 0

Erstwhile politician and consumer protection/environmentalist activist Ralph Nadar has peened (typo and it’s staying) the following open letter to Apple CEO Tim Cook, which says:

May 9, 2018

Tim Cook, CEO
Apple, Inc.
One Apple Park Way
Cupertino, CA 95014

Dear Mr. Cook:

Last week, you announced the largest single stock buyback in corporate history, amounting to $100 billion. Probably no more than you and two other Apple executives made this decision prior to receiving the expected rubber stamp from your congenial board of directors. Your company’s owners – Apple stockholders– were neither consulted nor asked for their approval.

Executive compensation packages rely on stock buybacks. (See The CEO Pay Machine by Steve Clifford, a former CEO who has served on corporate compensation committees.) From 2005 to 2016, stock buybacks by the S&P 500 totaled $5 trillion – equal to half of net income and twice as much as paid to shareholders in dividends. By the end of 2018, this figure will grow to well over $6 trillion. The owners of these companies – the shareholders – were not asked by management for their approval. After all, it is their big money, notwithstanding the out-of-control reliance on the “business judgment rule.” Were they given the clear choice between stock buybacks or dividends, most shareholders would have preferred receiving this surplus in cash dividends now.

With your $100 billion announcement, you are telling shareholders, your company’s owners, without a detailed explanation regarding other options, that this is the best you can do to advance their interests. This is short-term nonsense, except for its positive impact on executive compensation metrics.

Studies have shown that stock buybacks are just one variable in a large matrix of variables – internal and external to the company – that shape stock price and they are a weak variable at that. (See attached list of studies). You can examine major company stock buybacks for yourself (e.g., Cisco and Walmart) and see the accuracy of that observation. Cisco, after huge buybacks and much greater profits and size, has its stock about one-half of its March 2000 value.

It is the better part of prudence and foresight for you to pursue two courses of action. First, suspend the $100 billion decision or its implementation. Second, enter into a professional, detailed exchange with your shareholders – institutional and individual – explaining why you do not think there are better uses long term and short term for their $100 billion. Receive their considered feedback all in public for other interested parties to be informed and educated.

You also owe it to less-favored taxpayers in America who don’t have the offshore repatriation tax reduction demands that Apple and other companies regularly pursue. As Larry Fink, Chairman of the giant Blackrock investment firm wrote in his February 2018 letter to CEOs, “To prosper over time, every company must not only deliver financial performance, but also show how it makes a positive contribution to society. Companies must benefit all of their stakeholders, including shareholders, employees, customers, and the communities in which they operate.” (See attached).

In that context of proper expectations, here are some issues you can address in ways that would receive positive public reactions:

1. For less than 2 percent of your $100 billion buyback, or $2 billion, you could award a full year’s pay bonus to the 350,000 Foxconn workers who build your iPhones. Think of the economic relief and happiness that gesture would produce. These workers sweat for your immense wealth in difficult workplace conditions, unable to afford the Apple phones they manufacture for your company’s massive profits.

2. You can invest in research and development on ways you can diminish the effects of your company’s toxic supply chain that stretches from the dangerous mines in Africa to the hazardous solid waste disposal when users discard them. Many serious illnesses, fatalities, and injuries associated with manufacturing your products can be prevented.

3. With your reported reflective bent, you can make the case for reducing some of the collateral damage from excessive iPhone use by youngsters that comes with a sedentary life of obesity – now at risk-laden epidemic levels. Apple could invest in needed neighborhood recreational facilities all over the country.

4. Of course, you could always cut your prices for consumers. In the 1960s and ‘70s, such profit margins as Apple’s would have been an antitrust signal of possible monopolistic practices or market collusion.

5. Then there are the conventional applications of a cash-rich company to consider: productive new investments, raising employee salaries and pensions, improving hiring practices, and workforce training and consumer services.

6. Finally, it is unconscionable that the federal government decided to give Apple a huge tax windfall for repatriating its cash from abroad, while it refused to adequately fund the annual budgets of four critical agencies. The egregious examples of these budget inadequacies are the Center for Disease Control ($7 billion), the World Health Organization ($4.4 billion), the Environmental Protection Agency ($8 billion), and the IRS, whose strapped budget made it unable to attempt to collect $450 billion in uncollected taxes (it currently has a budget of only $11.5 billion).

Harvard economist John Kenneth Galbraith called attention to the problems associated with concentration of private wealth and public deprivation over 60 years ago.

The concentration of corporate power in ever-fewer hands, with expanding immunities and privileges denied “real persons,” continues to rise on matters of gravity to the American people. Conservatives call these privileges “Statism,” or “crony capitalism,” that has enormous influence over government dispensations. Mr. Fink’s cautions are worth pondering in more reflective formal settings.

The undersigned is not the only Apple shareholder who believes that stock buybacks, in contrast with other superior options, should be fully discussed with shareholders and then submitted to a binding shareholders’ vote. You will be hearing from others. Put your $100 billion stock buyback decision on hold.

I look forward to your thoughtful response.

Sincerely,
Ralph Nader

Source: The Official Site of Ralph Nader

Not using Filed Vault for Mac? This article may change your mind

Dan Uff May 12, 2018 1

“If you aren’t using FileVault on your Mac, it’s time to change that right now,” Jeff Gamet writes for The Mac Observer. “There’s a stunningly simple way to create a back door into your Mac using just the tools included with macOS, but all it takes to defeat the threat is FileVault.”

“FileVault is Apple’s full disk encryption feature that’s built into macOS. With it enabled, the entire contents of your SSD or hard drive is encrypted and accessible only when you log in to your user account. Booting your Mac into Safe Mode leaves your drive encrypted and accessible only after entering your passcode,” Gamet writes. “Apple uses AES-XTS AES-128 encryption with a 256-bit key to keep your data locked down and private. That’s great for keeping prying eyes out of your drive if your computer is lost or stolen.”

Gamet writes, “FileVault also protects you from the simple back door hack Tokyoneon…”

Read more in the full article here.

Set TV Now

SET TV Placeholder

Dan Uff May 11, 2018 1

Coming Soon

Security

GandCrab Ransomware Found Hiding on Legitimate Websites

Threatpost Security News May 11, 2018 0

The GandCrab ransomware continues to virulently spread and adapt to shifting cyber-conditions, most recently crawling back into relevance on the back of several large-scale spam campaigns.

What’s interesting is that GandCrab payload was found hiding on legitimate but compromised websites. These, when analyzed, were found to be riddled with vulnerabilities stemming from outdated software, highlighting one of the biggest issues when it comes to the security of cyberspace.

“Most small businesses aren’t aware that a new vulnerability has been released against a web framework and even if they did, most lack the expertise and time to be able to frequently update the software that the companies’ websites rely upon,” explained Cisco Talos researcher Nick Biasini, who, along with fellow researchers Nick Lister and Christopher Marczewski, examined the campaigns and published an analysis on Wednesday.

He added, “Adversaries, on the other hand, are able to quickly leverage these vulnerabilities and begin widely scanning the internet looking for potential victims. Leveraging these compromised sites in these types of spam campaigns is increasingly effective because adversaries don’t need to maintain persistence, or do much of anything other than copying a file to a specific location that they can point to systems, allowing for infection.”

Legitimate Payload Hosts

In all, Talos observed four, nearly identical offensives over the course of just one week at the beginning of May. Using e-commerce order lures, the emails included rudimentary body text and either an attached ZIP file or VBScrip file, which, when opened, pulled GandCrab off a website.

Digging deeper, the researchers found that the malware was actually being served from legitimate websites rather than malicious links, including one for a courier service in India, and a WordPress site for an herbal medicine purveyor.

After examining the Indian website, it became apparent that a host of issues were present in the website’s code, including the use of default credentials and multiple MySQL vulnerabilities. As for the WordPress site, it was running a version of the content management system that was more than a year out of date. Both also have publicly exposed admin pages for the web frameworks they’re using.

Sites that use antiquated software are easy pickings for adversaries, and Biasini noted that using them to serve up malware saves “time and money, doing things like registering domains, buying VPS, and configuring a web server to host the files.” The other added advantage is that bad actors can benefit from the web reputation of the site they compromise, which could help bypass some blacklisting technologies, in theory.

“This malware is the latest in a long line of examples of why stopping malware distribution is a problem, and shows why securing websites is both an arduous and necessary task. As a clear example of how challenging resolving these issues can be, one of the sites — despite being shut down briefly — was seen serving GandCrab not once, but twice, over a few days.”

The Payload

GandCrab spreads via the RIG and GrandSoft exploit kits, as well as via email spam as seen in the latest campaigns. However, there’s also a GandCrab Affiliate Program, according to recent research from Check Point, which pays participants about 60 percent to 70 percent of the ransom revenue in return for full technical support. The firm observed one of the largest affiliates distributing 700 different samples of the malware during the month of March alone.

“[GandCrab] is under almost constant development, with its creators releasing new versions at an aggressive pace,” Talos’ Biasini said. “It does the typical things ransomware does, including encrypting files with the .CRAB extension, changing the user’s background and leveraging Tor for communication.”

For instance, the malware quickly morphed to get around a free decryption tool. A joint operation in February by Romanian police, Bitdefender and Europol hacked into the malware’s infrastructure, gathering analysis that ultimately produced a tool allowing victims to decrypt their files for free. But a new version of the bad code quickly emerged within a month, with a fix for the critical encryption flaw that would have allowed a universal decryptor.

Even though cryptomining has become the next big thing in malware, there are still billions of dollars to be had in the ransomware field. With tactics like using legitimate sites to hide the payload proving to be consistently effective, reaping those dollars becomes an easier task than it would be otherwise.

“Threats like GandCrab are going to continue to emerge time and time again,” Biasini said. “There are millions and millions of web pages running on platforms that have thousands of vulnerabilities. Since most of these pages are created and maintained by small organizations that don’t have the knowledge or resources to react to emerging vulnerabilities, this will continue to be a problem for the foreseeable future. As long as adversaries are able to hide their malware on legitimate sites, web reputation systems are going to be compromised.”