Until recently I always considered interruptions a massive blocker for my productivity, for as long as I can remember those around me preached that it impacted their development efficiency and so that’s what I believed.
Traditionally i’d lose at the very least… 10 to 20 minutes of progress per interruption, getting back into the thought process and immersing myself in the code would become more and more difficult throughout the day. It wasn’t unusual to find myself at 6pm with a sense of nothing achieved.
How to prevent interruptions?
The headphones : A great pair of headphones makes a massive difference for concentration. When there’s too much noise to focus I’ll often sit there with them on, even without music. They’re also the universal sign for “piss off, i’m busy!”.
Hot-desking : If your workspace offers desks where you can rotate to it can be a great way to switch things up and escape the usual crowd. Definitely consider lunch, meeting rooms or even cafe’s (in the less chaotic periods of course).
Busy calendar : This works well with hot-desking, block out periods in your calendar to prevent unexpected meetings, take it one step further and move locations so you don’t get walk-ins.
Being direct : Naturally people don’t want confrontation which is why we often give in to assisting or answer questions on the spot. Ask people to direct the questions in bulk via email or your favourite chat application (slack ftw). Repetition is key!
Closing applications : A good portion of time is spent checking emails and responding to messages, the easiest solution is to close these applications and dedicate a time of the day to check and respond.
Moving in-to a Tech Lead (the sponge) role meant I had to suddenly be reactive and available especially for my team. Fortunately and unfortunately I was forced to break that developer mentality if I wanted to develop myself and my career, strangely enough interruptions are now my daily life.
The past few months I’ve seen myself become more resilient when diving back into code, I guess exposure to the “negatives” wasn’t so bad after-all…
Interruptions are just a natural part of work life the quicker you stop resisting and embrace these pain points the quicker you’ll learn and adapt.
Phishing is a method of obtaining sensitive information whilst disguising as a trustworthy source and can be pulled off with very little coding knowledge. It remains one of the most widely and successfully used scamming methods world wide. In 2016 Australia alone lost nearly $300 million, the ACCC reported in June that only $260,000 had been lost within 2017 although that number is nothing compared to the previous year there still remains those unreported cases.
Most recently 110 million users (and growing) received a Netflix Email scam that’s well designed making use of branding and existing email templates the company sends. The initial destination that the user clicks through to is a fake site, a destination that looks legitimate but built purely to capture the username and password of those who submit the form.
A few weeks back I was sent an SMS from “CommBank” saying my account was locked and requires additional verification. Unfortunately for these scammers I’m not with CommBank and I’ve read about these scams before. Straight away I was able to identify that the link in the SMS wasn’t legitimate due to the domain and lack of “https”, although that could easily redirect to a secure server.
Telstra offering malicious content detection via DNS
Clicking on the link brought up something I hadn’t seen before, a warning from my ISP that the page contained Malicious Content. I’d seen Google and other companies prevent a user from landing on the destination before but not an Australian ISP. This is great news for those who aren’t aware of the scam or simply suffering from a brain fart. It did make me wonder just how many users clicked on the link before someone reported it to Telstra… then it made me think even more“I wonder if i can scam the tech team at work”.
Orchestrating the scam
The tech team at CarsGuide consists of Developers, DevOps and Testers all worthy opponents for my scam.
First I identified a source that everyone has access to and requires some sort of personal verification to get in, I decided on our internal Wiki. I opened the URL in incognito mode so the login form would be presented and hit CTRL+S saving the site, then opening it on my machine to confirm it viewed correctly.
Next up I needed to change the location that the form posts to so I can capture data. I opened the html file in a text editor and searched for the <form> element then changed the action to point to my own script to record the POST data and redirect to the real location that the user is thinking they’re going to.
I then setup gotcha.php to log only usernames (although logging passwords was tempting) and redirect the user to the actual Wiki page that I wanted them to believe they should be viewing.
Now the files are sorted I need somewhere to host them along with a domain that can aid in tricking. I didn’t go all out here which would of involved buying a similar domain name as the Wiki there were a few other internal blockers preventing me from using the word “wiki” in my domain as well, I settled with an old domain I hadn’t used for a long time that looked nothing like the wiki one “event.cat”.
The final part to the plan is send an enticing email with the URL masked, easy enough to achieve this using a URL Shortener service like bit.ly or goo.gl. This is where I’ll throw most people as it’ll be unexpected that a colleague will be attempting to steal their personal info. I’ll use a previous email I sent about a Wiki entry to piggy-back.
A few hours into it and i’ve got some hits. I had to tell 1 person to keep quiet so my cover wouldn’t be blown as they’d caught onto it being “dodgy”, later I had some more people approach me asking about the weird link and how they didn’t click it.
The mailing list contained 27 people, got 12 clicks on the link and 17 email opens. With a total of 6 people caught within the 5 hours I let it run for.
Note: I asked permission from the higher ups before going ahead with anything.
How to identify the scam
There’s several things to look out for with these emails, SMS’ and sites
Do you know the originator/source. Does that email address or phone number look familiar?
Link shorteners are used to help mask the destination of a URL. bit.ly and goog.le are popular ones, both of which have public analytics so you can see the real source and just how many locations the email may of been sent to. https://goo.gl/#analytics/goo.gl/u6yJYW/all_time — https://bitly.com/2mQEBxU+
While it’s not wise to click a link that looks funny (malware could be on the other end) if you do, does the destination have a secure connection (https)? Check the base domain, commonly these URLs with have bits of the real source in them to help trick you e.g. http://commbank.banking.info
If you’re finding it originated from a friend, family or people you work with ask the person directly if they sent the email. If they haven’t then it’s a good chance their email has been compromised or spoofing method has been used.
What’s the world doing about phishing?
A huge amount of time and money is invested by email providers, browsers, antivirus and ISPs companies to help prevent these scams. Email providers are certainly on the forefront of prevention and recently Google applied more updates to Gmail for early detection. The best email providers will pick these scams up and move them to your spam inbox as well as label them with warning messages but this isn’t guaranteed to get 100%.
The nature of tech means things are constantly changing, there will always be scams online which makes keeping yourself informed the best defense.
Learning & Development is a crucial part of career progression, it’s easy for employees to fall into a rut of the same old tasks every day and not put any thought into your future, we develop a comfortable working environment so change becomes a distant memory, after-all humans are naturally lazy.
That distant memory pops back up though…. staleness develops in the workplace and an employee gets bored, the itch develops and is suddenly an itch to jump ship and look for something fresh. This is where Learning & Development fits in and should be applied to companies of all sizes, it’s a prevention of sorts.
Going back and looking at my years of being a developer across several companies it was rare for my employer to offer a solid L&D plan and even rarer for me to keep on top of the task of finding what’s new and what I could attend. I feel that companies can easily dismiss the idea of regular L&D due to cost of courses and losing the employee for day/s, but the end result will be happier employees that are guaranteed to stick around for longer.
Some of the L&D we offer at Carsguide within the Product and Technology team:
Dedicated budget for training which can be spent on just about anything.
Subscriptions to online courses: Drupalize.me, Laracasts, Udemy
Regular attendance to certification courses e.g. AWS, CSM, CSPO
Regular meetup attendance
Brown bags hosted by employees and externals
Recently I attended AxisAgile — Certified Scrum Master Training (CSM), a 2 day information packed training session. This course covers a lot more than the basics of Scrum & Agile diving deep into hands on activities and table discussions whilst being presented in an easy to understand yet professional way. I came back to work with a wealth of knowledge and a fresh outlook on what I can provide to the company.
I’ve compiled a list of helpful links to for those out there who may be in the dark, enjoy!
Courses
https://www.coursera.org - 2000+ courses from schools like Stanford and Yale - no application required. Build career skills in data science, computer science, business, and more. https://generalassemb.ly - Master new skills in design, marketing, technology, and data — online or at our campuses around the world. https://www.axisagile.com.au -Scrum Alliance Certified Agile Training. Scrum coaching and consulting https://www.edx.org/ - EdX offers free online courses and classes. Find the latest MOOC from the world’s best universities including MIT, Harvard, Berkeley, UT and others. Topics include business, computer science, finance, history, literature, math, science, statistics and more.
https://www.meetup.com/en-AU/Sydney-Coding-Bunkai/ - A Coding Dojo is an informal gathering of coders that uses programming challenges, games, mobbing and ping pong sparring to improve their skills and understanding in a friendly environment.
https://www.meetup.com/en-AU/sydneycocoaheads/ - CocoaHeads is a group devoted to discussion of Apple Computer’s Cocoa and CocoaTouch Frameworks, Objective-C and Swift programming, for iOS and MacOS. During monthly meetings, members present on their projects and offer tutorials on various programming topics. Sydney CocoaHeads meets on the THIRD Thursday of every month at the offices of Atlassian in Sydney’s CBD.
DevOps
https://www.meetup.com/en-AU/AWS-Sydney/
Testing
https://www.meetup.com/en-AU/Sydney-Testers/ - Sydney Testers is about smarter software testing. We are a group of people with a focus to improve testing for Sydney. We operate under a shared set of values and principles. We seek to practice high-value testing rather than so-called “best practice”.
https://www.coursera.org - 2000+ courses from schools like Stanford and Yale - no application required. Build career skills in data science, computer science, business, and more. https://generalassemb.ly - Master new skills in design, marketing, technology, and data — online or at our campuses around the world. https://www.axisagile.com.au -Scrum Alliance Certified Agile Training. Scrum coaching and consulting https://www.edx.org/ - EdX offers free online courses and classes. Find the latest MOOC from the world’s best universities including MIT, Harvard, Berkeley, UT and others. Topics include business, computer science, finance, history, literature, math, science, statistics and more.
https://www.meetup.com/en-AU/Sydney-Coding-Bunkai/ - A Coding Dojo is an informal gathering of coders that uses programming challenges, games, mobbing and ping pong sparring to improve their skills and understanding in a friendly environment.
https://www.meetup.com/en-AU/sydneycocoaheads/ - CocoaHeads is a group devoted to discussion of Apple Computer’s Cocoa and CocoaTouch Frameworks, Objective-C and Swift programming, for iOS and MacOS. During monthly meetings, members present on their projects and offer tutorials on various programming topics. Sydney CocoaHeads meets on the THIRD Thursday of every month at the offices of Atlassian in Sydney’s CBD.
DevOps
https://www.meetup.com/en-AU/AWS-Sydney/
Testing
https://www.meetup.com/en-AU/Sydney-Testers/ - Sydney Testers is about smarter software testing. We are a group of people with a focus to improve testing for Sydney. We operate under a shared set of values and principles. We seek to practice high-value testing rather than so-called “best practice”.
https://www.coursera.org - 2000+ courses from schools like Stanford and Yale - no application required. Build career skills in data science, computer science, business, and more. https://generalassemb.ly - Master new skills in design, marketing, technology, and data — online or at our campuses around the world. https://www.axisagile.com.au -Scrum Alliance Certified Agile Training. Scrum coaching and consulting https://www.edx.org/ - EdX offers free online courses and classes. Find the latest MOOC from the world’s best universities including MIT, Harvard, Berkeley, UT and others. Topics include business, computer science, finance, history, literature, math, science, statistics and more.
https://www.meetup.com/en-AU/Sydney-Coding-Bunkai/ - A Coding Dojo is an informal gathering of coders that uses programming challenges, games, mobbing and ping pong sparring to improve their skills and understanding in a friendly environment.
https://www.meetup.com/en-AU/sydneycocoaheads/ - CocoaHeads is a group devoted to discussion of Apple Computer’s Cocoa and CocoaTouch Frameworks, Objective-C and Swift programming, for iOS and MacOS. During monthly meetings, members present on their projects and offer tutorials on various programming topics. Sydney CocoaHeads meets on the THIRD Thursday of every month at the offices of Atlassian in Sydney’s CBD.
https://www.meetup.com/en-AU/Sydney-Testers/ - Sydney Testers is about smarter software testing. We are a group of people with a focus to improve testing for Sydney. We operate under a shared set of values and principles. We seek to practice high-value testing rather than so-called “best practice”.
Like many I grew up playing Pokémon and watching the TV series. Initially created in 1995 the brand still remains extremely popular with children and adults today. With over 45 games, 4 TV Series, 5 TV specials and 19 Movies being created, the brand has earned an easy $57.65 billion in revenue as of 2015.
The latest addition to the series is a new game 'Pokémon GO'. The official launch from closed beta to the public occurred today (6th July 2016), with thousands of downloads on both iOS and Android devices. The game is still very much in it's early stages meaning we could see major changes for this child hood favourite.
Wearable accessories aren't yet available but concepts have been released. The idea is to add easability, improving game play so you don't need to constantly look at your mobile device. It also makes for a free form of marketing for the game due to the distinctive design and colours.
The main company behind this augmented reality game being Niantic, Inc, formally an internal startup within Google which branched off in August 2015. Niantic are well known for an already popular MMO location based game 'Ingress' which gained more publicity in Sydney, Australia as of recently due to an Anomaly, an event related to the story and gameplay.
The partnership with Pokémon company Nintendo brought with it a '$20M Series A' investment round and in February 2016 an additional $5M funding to ensure the production and launch of the game.
I'm sure this is only the beginning for the new game and certainly won't be the last thing we see from the Pokémon brand.
** Update 7th July - Trainers around the world may be delayed due to ongoing server issues. Many are unable to get past the login screen, the issue more than likely related to the surge in app downloads and traffic to their servers.
For the past few years now I've endured what I consider to be "cancerous" social media posts and new forms of hoaxing which usually remained within Facebook but as of lately has spread to LinkedIn a social media platform which is aimed at being more professional.
I'm unsure if I'm seeing it across more networks now because my network size has increased or that maybe people are becoming more comfortable with these social media actions "like" and "share" so much so that they've lost their meaning.
So many posts are thoughtlessly liked and shared so much so that browser add-ons/extensions were created to block or replace certain content that many deemed unnecessary.
Technology inept or gullible?
When there's new technology, sites or games there will always be forms of hoaxing/scamming with it. Over and over I'm seeing Facebook Like Farming which appeal to human emotions to gain page likes. Commonly these pages are then sold off and you'll wind up seeing a post from a page you swear you never liked.
Greed could be a factor in our quick actions because lots of people are convinced Apple, BMW and other big companies give away hundreds of thousands to anyone onlinefor just liking their new Facebook Pages and sharing their "Give away"posts.
So what's the solution here? Should social media companies be handling this in a better way? Or should we be educating ourselves about technology a bit more before using it?
Think before you do! Using Google to find out more and sites like Hoax-Slayer are great for myth busting.
Recently I've had a huge influx of traffic to my site to the point that Apache reached it's max connections and MySQL couldn't respond in time. Turns out a small DDOS was occurring.
It's common for popular software like WordPress to become a target for bots that roam the internet crawling servers for exploits to add to their botnet. Unfortunately it's something that not all hosting providers will help detect and stop that's why specialist services like CloudFlare have become available.
After noticing the server grinding to a halt I went through some basic steps to determine where the fault may be.
Using another server or device on another network to check the site, a popular free service is "Down For Everyone or Just Me"
Use networking commands like ping thomasrothwell.com and traceroute thomasrothwell.com to determine if the domain provider or DNS could be effected. Again sites are available to-do this if you don't have command line available. Ping.eu
SSH into the server to check the logs "/var/log/" is the most common directory but will of course vary depending on your Hosting Provider and OS. Check your web server and database logs, this'll help narrow down what's falling over first.
Check your server resources, RAM & CPU usage may be spiking. Again commands like top will help identify the main consumers.
If you come across a suspect IP you can use an IP Address Abuse Database to help identify it's legitimacy.
It turned out to be a similar IP range hitting the server and doing a POST request to a WordPress file xmlrpc.php. This is a common target as it's used to communicate with third party services like RSS and plugins.
185.130.4.197 - - [04/May/2016:10:59:34 -0400] "POST /xmlrpc.php HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)"
185.103.252.3 - - [04/May/2016:10:59:33 -0400] "POST /xmlrpc.php HTTP/1.0" 500 609 "-" "Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)"
I stopped the web server from running so the server would free up some resources in-order to work a bit quicker as the response time when typing was very sluggish.
service apache2 stop
I grabbed the IP Addresses via the access logs and then used IPTABLESto block the connections.
Recently I had a deeper encounter with Ransomware a form of malware that’s spreading at an alarming rate. It works by restricting the users computer or data then demands that they pay a ransom in order to gain access back. While it's not a new thing creators seem to be bypassing even some of the more advanced virus scanners which offer out of the box web & download scanning.
In 2015 alone the FBI received at least 2,500 complaints related to ransomware attacks, which amounted to approximately $24 million in losses to the victims. Australians have reportedly lost millions from similar forms of malware and online scams this year alone.
This form of malware is commonly spread via phishing emails. These emails appear to come from legitimate companies, luring you to click a link which then offers a website that "appears to be" correct. Visually the site could look identical but it's really a fake, the easiest thing to-do is compare web addresses.Real site VS the fake "http://auspost.com.au/" isn't the same as "http://auspost-1f290.rnd.net.au".
My mother had unintentionally downloaded and opened a self executing zip file even with my rants about opening certain emails, files and NOD32 being installed. "Crypt0Locker" was still downloaded and ran. The program copied itself to a few locations while encrypting or at least obfuscating the source of files and then adding the file extension ".encrypted". A browser window appeared with instructions on what had just happened and how to gain control of the files again.
The instructions state to deposit X amount of bit coins into a specific address.
The site being served is using the Tor network along with the crypto-currency Bitcoin, unfortunately this makes it a lot harder for law enforcement to track and and put a stop to these malicious people.
So to pay the money or attempt a fix myself? Of-course I went with fix it myself which lead to several hours of research, trial and error then repeat.
The Quickest Fix
A handy feature known as System Restore can resolve this. Unfortunately the feature isn't always on or a restore point is a long time ago. If you're one of the lucky ones you may have a restore point that's recent you can follow the instruction on the Microsoft website to-do this.
The Alternate Fix
First you'll want to remove any traces of the malware to prevent re-infection or at the very least prevent the window from constantly popping up in your face.
The easiest solution is to use a free trial of Malware Bytes or Hitman Pro let one of these scan your entire system and follow the prompts.
Next is attempting to restore files. Shadow Explorer may allow you to see versions of files which could allow restoration. Unfortunately this is a bit of a manual process.
Even the most careful get hit at some stage so the key is educating yourself even if it's a little, try following some of the points below:
Use a Virus Scanner and keep it up-to date
Don't open emails unless you're 100% certain it's safe. If the Email Spam filter didn't pick it up then you can examine the From address to check the legitimacy.
Download files from websites that are being served from the correct Web Address
Use more modern and secure browsers such as Firefox or Google Chrome
TL;DR - A new version of Crypt0Locker and variations exist where no easy fix is available. The older version of Crypt0Locker had a method to restore files and remove the malware.
You could have a variation of the virus, so these steps may not work for you. To be precise on what actions should be taken you can upload an infected file to this site: https://id-ransomware.malwarehunterteam.com/ which will detect the form of ransomware you've been hit with.
Finally keep an eye on Scamwatch - https://www.scamwatch.gov.au/
Wearable accessories aren't yet available but 
The main company behind this augmented reality game being 
Greed could be a factor in our quick actions because lots of people are convinced Apple, BMW and other big companies give away hundreds of thousands to anyone online for just 
A browser window appeared with instructions on what had just happened and how to gain control of the files again.