Nearly 70 per cent of Canadian hybrid workers go to the office two to three times a week, a new Capterra report that surveyed 1,021 part- and full-time employees working at least some days from the office has found.

The increased prevalence of hybrid work comes as companies like IBM, Amazon, Disney, Google, and even remote work poster child Zoom have vehemently pushed return to office (RTO) mandates.

Another report from Resume Builder also revealed that 91 per cent of companies will require employees to go to the office on a monthly basis, and 75 per cent will require employees to work from the office weekly.

Companies are even taking it a step further, with 95 per cent saying that employees will suffer consequences if they don’t comply. Their employment, bonuses, and salaries will likely be at risk, Resume Builder says. Reportedly, 80 per cent of companies will also track office attendance in 2024.

The Capterra report says that the RTO trend after COVID-19 restrictions temporarily closed some workplaces was perhaps influenced by employers who don’t want their investments in physical office space to go to waste.

But many organizations requiring employees to come to the office at least sometimes also tout increased productivity, valuable social connections, and higher trust at work, Capterra acknowledged.

However, some businesses perceive such rigid RTO policies to clamp down on things like absenteeism can be perceived as disregarding employees’ well being. Several companies have, in fact, seen employees quit en masse following stringent in-office mandates.

In Canada, only 23 per cent of surveyed employees in Canada report having company-wide mandatory in-office days. The same number of surveyed employees said their department also enforces mandatory in-office days.

But employees should be incentivized back to the office, Capterra says.

Nearly a third of employees who go to the office less than five times a week (32 per cent) said perks like free snacks and coffee would motivate them to come in more often.

“Free food might seem like an oversimplified tactic for boosting office attendance, but it could be a deciding factor for many workers,” said Tessa Anaya, analyst at Capterra, in an interview with ITWC.

She added, “Factors such as social events, a better office location, or even a more diverse and inclusive work environment were selected by far fewer employee respondents, which speaks to the motivational power of a good cup of coffee.”

The Resume Builder report also noted that a whopping 91 per cent of companies say they will provide incentives to employees for going into the office. These incentives include happy hours (52 per cent), catered meals (46 per cent), and upgraded office space (41 per cent). But fewer employers will offer bigger incentives such as raises (40 per cent) and child care benefits (37 per cent).

Other top incentives to increase employee attendance are related to the physical space offered, Capterra noted. Twenty-eight per cent said having private or isolated areas would motivate them to come more often to the office, while 27 per cent said wellness facilities like a gym would have the same effect. These spaces could serve to reduce distractions as well as support mental health in the workplace.

“Everyone is different, however,” added Anaya. “It’s important to keep the preferences of your staff at top of mind when strategizing your RTO efforts. Asking them directly via employee survey may be the best bet to ensure that the amenities your office is providing are well received by your employees.”

The post Hybrid arrangements tripled since 2022, trend far from over, says Capterra first appeared on IT World Canada.

Healthcare providers covered by Ontario’s privacy law have an extra incentive to follow provincial data protection regulations: They now face administrative fines for serious violations of the provincial law.

As of Jan. 1, the Information and Privacy Commissioner of Ontario can issue penalties of up to a maximum of $50,000 for individuals and $500,000 for organizations that violate the Personal Health Information Protection Act (PHIPA).

Fines — officially called administrative monetary penalties (AMPs) — can be issued to encourage compliance with PHIPA, a statement from the commissioner’s office says. Or, it adds, penalties can be applied to prevent a person from deriving — directly or indirectly — any economic benefit from contravening the law.

“The IPC will not use AMPs as the default response to breaches,” the statement says. “They will generally only be used as an enforcement option for more severe violations of PHIPA, not in cases involving unintentional errors or one-off mistakes.”

“The IPC will take a measured approach in response to PHIPA violations, providing
education, guidance, informal resolution, and recommendations when less severe
violations occur.”

Organizations have known this was coming since 2020, when the Ontario legislature amended PHIPA to give the IPC additional enforcement powers. The new powers didn’t come into effect until Jan. 1, 2024.

Quebec is the only other province that has authorized the levying of administrative monetary penalties as part of its privacy law that covers the private sector. The federal government is currently considering Bill C-27, which would also authorize administrative penalties.

The IPC has issued guidance to organizations on how administrative penalties for healthcare providers will be applied. The commissioner also can issue binding orders requiring individuals or organizations to take specific actions to address data protection shortcomings.

In the vast majority of healthcare data breaches investigated, individuals show a genuine willingness to report, take responsibility for, and remedy errors when they occur, the guidance notes. Incidents often involve inadvertent errors, one-off contraventions with relatively minor impact, or some at-risk behaviours in need of coaching and course correction, the paper says. “In most cases, the individual or organization is highly responsive and co-operative in rectifying the situation. Education, guidance, early resolution, and recommendations for corrective measures are often the only tools the IPC needs to use in such cases.”

Under PHIPA, a health information custodian is prohibited from collecting, using, or disclosing personal health information without a patient’s consent, although under some circumstances, data can be collected indirectly.

The new powers come just as the IPC starts an investigation into the recent ransomware attack that hit five hospitals linked to a common shared IT provider. The commissioner’s office says it plans to make its findings public.

Around the world, hospitals are targets for cybercrooks looking for credit/debit card data to steal, and personal information as leverage for extortion or blackmail from hospital administrators.

For-profit hospitals are better able to fund cybersecurity than those — such as Canadian institutions — that rely on government support. Earlier this year, the Canadian Internet Registry Authority (CIRA), which oversees the .ca domain, said  “lack of focus” of management and lack of money are the biggest factors blocking the improvement of the cybersecurity of Canadian hospitals.

It’s not only hospitals that are targets. Data on 3.4 million Ontario mothers, newborns, and children collected over the past 10 years was stolen earlier this year from the MOVEit file transfer server of the provincially-funded Better Outcomes Registry & Network Ontario, also known as BORN. It was one of more than 2,000 organizations around the world victimized through a zero-day vulnerability in MOVEit Transfer.

Last year, the IPC issued 35 decisions involving complaints of alleged PHIPA violations involving physicians and hospitals. Many involved demands for access or corrections to records.

The post Ontario healthcare providers now face possible fines for ‘severe’ data privacy violations first appeared on IT World Canada.

Prepare for upcoming privacy legislation

Welcome to Cyber Security Today. It’s Wednesday Janaury 3rd, 2024. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

Happy New Year. And welcome to the first show of 2024.

This will be a busy year for privacy legislation in Canada and the U.S. In Canada committee hearings will resume this month on the proposed Consumer Privacy Protection Act and the accompanying Artificial Intelligence and Data Act. In the U.S., 10 states have consumer privacy legislation in various stages before their legislatures. In Massachusetts, legislators are dealing with three proposed bills. Here’s a link to the status of privacy legislation in all American states. Not all the proposed bills will pass and be signed into law this year. Remember, this is an election year in the U.S. Meanwhile privacy laws in Texas and Oregon will come into effect on July 1st, and in Montana on October 1st.

Cybercrooks marked the holiday week by celebrating “Leaksmas.” Researchers at Resecurity say on Christmas Eve several threat actors on the dark web dumped tens of millions of pieces of stolen data that could be used in phishing scams and fraud. The biggest chunk of data was 22 million records stolen from a telecommunications provider in Peru. The second biggest chunk involved data stolen from the U.S.

First American Title Insurance, which provides real estate title protection in the U.S., is recovering from a cyber attack last month. In its most recent post the company said several tools for title agents are back online. On December 20th the company disconnected all IT systems from the internet because of the attack. Although it doesn’t use the term ‘ransomware,’ the company says data on some non-production servers was stolen and encrypted.

Speaking of ransomware, researchers at Security Research Labs say they created a decryptor that may help victims hit by the BlackBasta strain of ransomware. However, according to the news site Bleeping Computer, the gang has fixed the bug that allowed the solution to be created so the decryptor may not work with newer attacks.

Researchers at a Singapore cybersecurity company called CloudSEK have figured out how threat actors are exploiting persistent cookies on Google’s platform. The problem is in an undocumented Google OAuth endpoint called MultiLogin. The exploit enables continuous access to Google services even after a user’s has reset their password. Word of the exploit spread after a developer publicly reported it in October and now several threat actors have included it in their information-stealing malware.

Here’s another warning to application developers looking for code to use from the NPM registry: Beware of a package named “everything” posted by a user named gdi2290. They also go by the name PatrickJS. Installing this package will create a mess of your code. Researchers at Checkmarx call this either a prank or digital mischief. Whatever the name, PatrickJS has apologized but so far the package can’t be uninstalled. Nor it be deleted from NPM.

Researchers at McAfee have identified 10 Android apps stuffed with malware. They include a so-called calorie counter, a numerology app and several games. As I’ve said before, just because an app is in the Google Play store or a well-known app store doesn’t mean its safe to download. Be suspicious of an app you take that demands access to Android’s accessibility services unless it’s really needed — and a game won’t need it. Accessibility services are for helping people with disabilities to use smartphones.

Finally, big-name digital camera manufacturers are trying to fight the risk of images being altered by mischief-makers or threat actors using artificial intelligence. PC Magazine reports that Nikon plans to start offering mirrorless cameras with digital authentication technology for professional photographers. Nikon and other camera makers are also backing a tool called Verify people can use to check the authenticity of an image with a digital signature that will show the real creation date, location and other credentials of the image.

Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.

The post Cyber Security Today, January 3, 2024 – Prepare for upcoming privacy legislation first appeared on IT World Canada.

The X/Twitter account of Google’s Mandiant cybersecurity service has been taken over by a hacker who is seemingly promoting a cryptocurrency scam.

The incident happened very early Wednesday morning, Eastern time. As of Wednesday afternoon, the account called Mandiant was still run by an operator called ‘Phantom.’ Messages posted refer to “token prices” and include a link to an app.

“We’re looking into it,” Mark Karayan, Mandiant’s media communications lead for threat intelligence, told IT World Canada. “It’s definitely been taken over … We’re working to get it resolved.”

Karayan couldn’t say how the incident happened.

Google acquired Mandiant in 2022 for US$5.4 billion. Mandiant had been owned by FireEye, but was spun off after the parent company admitted in February 2021 that a threat actor had compromised the firm and made off with FireEye cybersecurity tools.

Google has been one of the leading IT suppliers pushing organizations around the world to adopt multifactor authentication (MFA) as an extra step to protect logins not only to its services, but also for any network-linked service. Google staff have had to use MFA for years. Since 2017, all Google employees were forced to adopt Google’s Titan key-based MFA to ensure staff aren’t victims of phishing attacks in which a victim is directed to a fake login site where their username and password can be copied.

It isn’t known if staff who had access to the Mandiant X/Twitter had to use security keys, which are USB sticks that have to be physically plugged into a computer to provide an extra login factor for access.

Still, experts note that, unless MFA systems are set up properly, hackers may be able to get around them by convincing IT support staff to reset passwords. If done through a man-in-the-middle attack, a hacker can get hold of a user’s session cookie to take over access.

RELATED CONTENT: Use these phishing-resistant authenticators

Perhaps by coincidence, the takeover of the Mandiant account this week comes with the revelation that the X/Twitter account of a Canadian senator was temporarily captured by a hacker.

The post Mandiant loses control of X/Twitter account first appeared on IT World Canada.

A “termination notice” sent to VMware channel partners by Broadcom on Dec. 22, as they were preparing to head out of the office for the holidays, did not leave many feeling the warmth of the season, said Jason Van der Schyff, the chief operating officer (COO) of private cloud infrastructure vendor Softiron.

The electronic notice Van der Schyff refers to, a copy of which was obtained today by Channel Daily News, begins by stating that “for more than two years, VMware has outlined its plan to transition from a perpetual to a subscription-based business model. This is consistent with the overall market trend toward cloud operating models and was reinforced with the launch and evolution of VMware’s Partner Connect Program.

“On December 11, 2023, VMware by Broadcom announced its simplified licensing model and solution portfolio. Broadcom and VMware are driven by technology and innovation and have a shared passion for, and commitment to, partner profitability and success. You are now well positioned to capture substantial growth opportunities for delivering advanced, innovative cloud infrastructure and associated services wherever your customers need.”

The big news, which took the form of a termination notice, can be found in the next paragraph, which stated Broadcom would be “transitioning” all of the VMware’s partner programs to the “by-invitation only award winning Broadcom Advantage Partner Program, effective Feb. 5, 2024.

“Effective today, we are also announcing changes to VMware’s partner programs which will exist through February 4, 2024. Please refer to the VMware partner program operative changes on the VMware by Broadcom Essential Partner Information page.

“Also, effective today, all VMware Partner Incentive programs will end on or before February 4, 2024.”

The by-invitation only part of the program means that actual invitations to join are scheduled to start being issued this month, and the timeline will vary by partner type and route to market, the notice stated.

Invitations, “will be sent to the partner identified primary and alternate contacts on file with VMware. Take this opportunity to ensure your company’s contact information is correct within the ‘My Company’ section of the Partner Connect portal home page.”

Van der Schyff countered that the  “greater channel has watched as Broadcom disassembled CA and Symantec, further limiting the available SKUs to make margin on. Seemingly irrespective of the promises of Broadcom, they are doing the exact same thing with VMware.

“Early in the narrative, we heard that Broadcom essentially had worked out how to pay for the US$60+ billion acquisition with the VMware revenue from the top 10 per cent of their clients. So, if the play here is to get as much revenue in as short time as possible, eviscerate VMware’s customer base, and move on to the next thing, they simply do not need their channel. I think that is exactly what we are seeing.”

It is not just many VMware partners wondering or worried about next steps, but end user organizations as well.

Andrew Moloney, Softiron’s chief strategy officer, wrote in a blog issued on Nov. 27, five days after the deal formally closed, “with the Broadcom acquisition now closed and the wide-reaching layoffs and restructuring starting to happen, another inflection point has been created.”

It is, he maintained, an inflection point that is “causing many IT leaders to re-evaluate their strategic options and chart the right path for the future – one that may or may not include VMware. I get to talk to many industry analysts in my role and they all tell me the same thing – everyone is looking for a credible alternative to VMware as their license renewals come due.

“And for those not willing or able to migrate all their workloads to the public cloud, their options are severely limited.”

Moloney added that anyone would be “hard-pressed to find a VMware customer who is happy with the cost of their VMware software licensing. And with a ~US$61Bn acquisition to pay for, prior form in that regard, and significant earnings promises being made to investors in an already saturated market, VMware customers are increasingly anxious that those licensing bills are only going one-way post-acquisition as Broadcom leadership exerts its authority.”

The post Broadcom drops bombshell with ‘termination notice’ first appeared on IT World Canada.

Xerox today announced that it will lay off 15 per cent of its workforce as part of a newly introduced reinvention and operating model.

The U.S. based corporation provides printing and digital document products and services.

According to its latest filing with the U.S. Securities and Exchange Commission (SEC), Xerox has 20,500 employees, which means 3,075 employees will be getting the axe.

The cuts are expected to take place this quarter.

Xerox said that the proposed reductions will be subject to formal consultation with local works councils and employee representative bodies where applicable. It added that it is committed to providing transition support to affected employees.

Its new organizational structure seeks to improve its core printing business, increase productivity with the formation of a new Global Business Services organization and accelerate revenue diversification through increased focus on its digital and IT services.

“The shift to a business unit operating model is a continuation of our client-focused, balanced execution priorities and is designed to accelerate product and services, go-to-market, and corporate functions’ operating efficiencies across all geographies we serve,” said Steven Bandrowczak, chief executive officer at Xerox.

The company has also restructured its executive team to support the new operating model, with several new appointments, and two departures: Joanne Collins Smee, executive vice president and president, Americas and Tracey Koziol, executive vice president of global offering solutions and chief product officer.

Bandrowczak thanked Smee and Koziol for their contributions to the company and culture.

The post Xerox to cut 15 per cent of its workforce first appeared on IT World Canada.

Major disruptions are expected in the cloud business this year which will see hyperscalers adapting, leaving an opportunity for challengers and startups to catch up, Forrester revealed in a new report.

Here’s what we can expect in 2024:

1. FinOps

FinOps Open Cost and Usage Specification (FOCUS), an initiative driven by the FinOps Foundation, will become the standard in 2024, Forrester predicts. This will compel cloud providers to align on cost reporting to give customers a vendor-neutral multi-cloud view of their resources.

Even Amazon Web Services (AWS), who initially held out from FOCUS, is expected to join the community in 2024, Forrester noted.

The collective voice of the user community, driven by FOCUS, will continue to be a game-changer in leveling the playing field between cloud providers and consumers, further explained Kyle Campos, chief product and technology officer (CPTO) at CloudBolt Software.

This will be even more critical, as 2024 will be the year that the cost to run an application will be the ultimate performance metric, while traditional metrics like CPU, memory, disk and network will become less important, he added.

He said, “As digitally transformed organizations continue their advance to the cloud, the cost-of-goods-sold will get linked intrinsically with operational and services measured at a finer-grained level; looking at specific tools, services, and algorithms for cost savings.”

Further, FinOps silos that drive friction and optimization pitfalls will find a breakthrough as conversations and solutions shift from “motivation” to “facilitation”, noted Campos. This means that FinOps practices will become a native part of its “golden paths,” on par with security and observability, as the trifecta of defaults in the delivery process, especially as the majority of forward-thinking IT organizations adopt Platform Engineering as a technology approach by the end of 2024, he explained.

Advances in AL/ML will continue to lower user complexity/friction and hence cost granularity in the FinOps solution ecosystem.

“What used to take hours of custom configuration, trial and error, will be a low friction conversation,” Campos said, adding, “AI/ML will facilitate Unit Cost solution inversion such that unit cost is provided to the user, not from the user.”

2. Oracle to take on the cloud monopoly

With its increased focus on performance and cost advantages, Oracle is expected to steal hyperscaler business for more than 10 major accounts bringing at least US$100 million in annual cloud spend each, Forrester said.

The increased interest in AI will also give Oracle the opportunity to offer massive compute power to help customers train and run their generative AI models on Oracle Cloud Infrastructure (OCI). The company offers a low-latency AI supercomputer with high performance and low-cost supercluster capabilities.

3. Hyperscalers to announce new regions

By the end of 2024, public cloud vendors will have announced and launched at least two geographically separated regions in every significant market, to stay ahead of sovereignty requirements, climate change challenges, and risks connected to geopolitical tensions — a feat that will total 30 new regions across the globe, Forrester claimed.

Indeed, service outages caused by factors such as the water leak in Google’s only Paris region in April 2023, a fire-related incident at OVHcloud in 2021, or a ransomware attack wiping out CloudNordic clients’ data in August 2023 are all putting pressure on hyperscalers to failover to foreign regions.

4. Prompt engineering

Hyperscalers, Forrester said, have all the building blocks for data science except for prompt engineering.

That will change in 2024 as generative AI and foundation models continue to boom.

In 2024, all hyperscalers will announce the preview or general availability of prompt engineering, Forrester predicts. For instance, Google Cloud put Grounding Prompt in the product vision of its AI platform.

That said, enterprise adoption will be limited. Most are expected to add prompt engineering talent internally, using business subject-matter experts and data scientists to accelerate model grounding and value delivery. This is due to incomplete contextual data and limited experience in natural language and prompt engineering among data scientists. As a result, cloud providers’ first-gen prompt engineering services will not suffice to address tailored fine-tuning needs.

5. Architecture reconsiderations

Forrester predicts that the first WASI offerings will emerge on major cloud platforms and quickly spread.

WASI enables a new concept: modular monoliths, which are different from just monoliths or microservices. While monoliths are tightly integrated and efficient, but hard to iterate with agile development practices, microservices break apps into smaller chunks for faster iteration but add production complexity and require more management overhead.

WASI-enabled modular monoliths, on the other hand, will allow WebAssembly apps to run server side and introduce a new way to compose components into larger integrated applications at runtime.

The full Forrester report is available for purchase here.

The post Cloud Predictions 2024: Costs control, sovereignty concerns, competitors and more to spark disruptions first appeared on IT World Canada.

The office of Canadian Senator Amina Gerba has confirmed the Quebec parliamentarian’s account on the X/Twitter social media platform was hacked this week.

Senator Amina Gerba

Walter Calderon, the Senator’s executive assistant, made the confirmation Wednesday in a telephone interview. It followed the disclosure of the hack on Tuesday by MalwareHunterTeam, a resource on ransomware for IT teams and security researchers.

According to MalwareHunterTeam, the account was renamed as “LFG” and — taking advantage of Gerba’s followers — was being used to promote a scam.

However, late this morning the account and its content had been restored.

Asked when Gerba knew she couldn’t get into the account, Calderon said that on Tuesday “she just realized she didn’t have access to her account. Like anyone would do, she tried her password but it didn’t work because the email was not associated with the account.”

Gerba, who had created the account herself to promote her work as a Senator, then notified the federal government’s IT department, Calderon said.

At the time he spoke to IT World Canada, he didn’t realize the account had been restored.

Calderon didn’t know if the Senator had implemented multifactor authentication to protect from login compromise.

Gerba was appointed to the Senate in 2021 by Prime Minister Justin Trudeau. She sits as an independent. She is a member of the Senate Foreign Affairs and International Trade Committee and the Human Rights Committee. She is also very actively involved in the Parliamentary Black Caucus and Senators for Climate Solutions.

This isn’t the first time a Canadian parliamentarian’s social media account was taken over.
In 2019, Twitter confirmed Senator Linda Frum’s account had been hacked. The threat actor posted racial slurs and some of Frum’s personal information, including her driver’s licence. Her access was quickly restored. In 2018, Conservative Senator Don Plett’s Twitter account was briefly taken over. Around the same time, Conservative MP Peter Ken reported he had been locked out of his Facebook and Instagram accounts.

In the U.S., Senator Joe Manchin’s social media accounts were hacked in 2018. In 2012, Senator Chuck Grassley’s Twitter account was taken over.

Suspected attackers of the social media accounts of politicians range from hacktivists to foreign governments.

X/Twitter offers this advice to users for protecting their accounts:

use a strong password that’s not used on other websites;
enable two-factor authentication as protection, in case an outsider is able to get hold of your username and password; 
require email and phone number confirmation from X to request a reset password link or code;
be cautious of suspicious links that claim to send you to X/Twitter. Always make sure you’re on twitter.com before you enter your login information;
never give your username and password out to third parties, especially those promising to get you followers, make you money, or verify you;
Make sure your computer software, including your browser, is up-to-date with the most recent upgrades and anti-virus software.
The post Canadian Senator temporarily loses control of X account first appeared on IT World Canada.

Cybercrooks have increased the number of new or stolen Gold checkmarked accounts from the X/Twitter platform offered for sale; they are a valuable way for threat actors to push links to malware on the social media site through what users will see as a post from a trusted source.

There has been a surge of dark web posts selling accounts with X/Twitter Gold verification., say researchers at Singapore-based CloudSEK. A “strikingly similar series of advertisements” was also seen in channels on the Telegram messaging site, the report adds.

X/Twitter offers users the ability to buy Gold, Blue and Grey tickmarks for a monthly fee, to enhance the credibility of their brands. Grey checkmarks have been set aside for NGOs and government bodies.

Some of the Gold accounts being sold on the dark web are new, allowing a threat actor buying one to change its name to one similar to a brand and impersonate the company or individual. Others once were controlled by individuals or companies but have been taken over by brute-force login attacks.

Prices range from an average of 30 cents for a new account to $2,000 for an aged account converted into Gold (all prices in U.S. currency). Prices go up depending on the number of followers of an existing and stolen account.

The sale on the dark web of Gold accounts has been going on since last March. CloudSEK says the number of shops and service providers today offering them “is humongous.” Most can be detected by running simple Google Dork queries.

The researchers worry that with the increase in availability on the dark web of Gold accounts, a huge wave of phishing or disinformation attacks will soon follow.

Usually buyers have access to an account for 30 days, which is the standard duration of X/Twitter Gold subscriptions.

The damage a stolen or fabricated Gold account can do is tremendous. The report gives as an example the September 2023 takeover of an account of the co-founder of the Ethereum digital currency. The hacker exploited his large following by posting a deceptive message
offering free non-fungible tokens (NFTs) to unsuspecting users. The malicious link embedded in the tweet directed users to a fake website that could drain cryptocurrency from their wallets. Despite being active for about 20 minutes, the hackers managed to siphon off  US$691,000 in digital assets before removing the fraudulent post.

The most common targets are X/Twitter accounts of organizations, created before 2022, that have not been used in a while or have been abandoned. Hackers will try to brute force the account, and, if successful, change the recovery email and contact details so the original owner can’t regain control. Then the account is converted to Gold depending on the ask by buyers.

Another tactic of hackers is to gather Twitter-based logins from information stealer malware. These logins are then validated using configs and brute force methods that will provide a positive response for working accounts. Then, on hacker advertising forums and websites, threat actors announce the account for sale, convert it into Twitter Gold, and sell it for as low as US$800.

Organizations can avoid their X/Twitter accounts from being abused by ensuring dormant accounts are closed if they have been inactive for an extended period, the report says. To ensure login credentials aren’t stolen, organizations have to enforce best password protection practices. Monitoring the organization’s feed for signs of X/Twitter hacking, including fake profiles, unauthorized product listings, misleading advertisements, and malicious content is also vital.

The post Stolen Gold X accounts are increasingly being peddled on dark web, says report first appeared on IT World Canada.

Any laptop user who routinely works with numbers faces the same challenge – they either need to use an external keyboard or carry a separate numeric keypad to work efficiently. Either way, it’s a pain: one more thing to carry around, extra weight, and it makes it virtually impossible to use the laptop on, well, your lap.

LG sought to solve that problem with the 15.6-inch 2023 Gram SuperSlim, list price C$1,699.99. In a sleek package that weighs less than a kilogram (990 grams, to be precise), it manages to include a powerful computer, good-sized FHD OLED screen, and (ta-da) a backlit keyboard complete with numeric keypad.

It features a 13th Gen Intel Core i7 processor, Intel Iris XE graphics, 32 GB of RAM, and a 1TB SSD, offering plenty of power and storage for the most demanding tasks.

My only complaint about the screen, which is crisp and bright, is that it’s only full HD (1920 x 1080) resolution; for me, that’s the bare minimum – I’ve been spoiled using QHD (2560 x 1440) displays. A lot more fits on the screen at higher resolutions (though of course, it’s smaller). It’s a matter of taste, and what makes your eyeballs happy.

But if the 15.6-inch screen isn’t enough, LG has also launched the C$500 16-inch +view external display that connects to the Gram via USB C.

The system comes with Windows 11 Home, and its Windows Hello biometric security is via facial recognition. There is no fingerprint reader.

The keyboard takes a bit of getting used to, since the laptop is a bit narrower than a standalone keyboard, but the keys are in the right places. I found that, because the machine is so slim (less than half an inch thick), the key travel is very slight – too little for my taste.

And users may be somewhat baffled by the alternate characters printed on the keys – they include both standard English characters and those for Canadian French (which won’t work unless you’ve chosen the Canadian multilingual keyboard in Windows).  But those are quibbles – the system, on the whole, works very well.

While the port collection isn’t spectacular, it is adequate: a couple of USB 4 type C ports with power delivery, display port, and Thunderbolt 4 support, plus a USB 3.2 type C port and an audio jack. The A/C adapter uses one of the USB ports. You’ll need a dongle or a hub for any other connections.

I was not impressed with the battery life, though. Slim and sleek equals less room for batteries, and it shows. Despite manufacturer ratings that claim much better, I got 5ish hours under my normal use. But, as the saying goes, your mileage may vary.

I also found that the system uses power even after it has been shut down – for example, on one occasion, at shutdown, battery was at six per cent, but when I rebooted, it was down to two per cent. Another time, it powered off at 66 per cent, but when I rebooted two days later, it was down to 49 per cent.

That said, the LG Gram SuperSlim compensates for these shortcomings with its performance and impossibly light weight. And with that all-important numeric keypad, which makes working with spreadsheets and other number-centric tasks so much easier.

The post LG Gram 15 2023 review: Impossibly light with lots of power first appeared on IT World Canada.