History of HTML

 HTML (HyperText Markup Language) is the standard language used to create and design web pages. Its history is marked by several key developments:

1. Early Beginnings (1989-1990): HTML was proposed by Tim Berners-Lee, a researcher at CERN, as part of the development of the World Wide Web. The initial idea was to create a system that could allow researchers to share documents and data across different computers. 

2. HTML 1.0 (1991): The first version of HTML was introduced with basic elements such as headings, paragraphs, links, and lists. It was designed to be simple and was primarily intended for sharing scientific documents.

3. HTML 2.0 (1995): HTML 2.0 was standardized by the Internet Engineering Task Force (IETF). This version introduced new elements like tables, forms, and more extensive attributes. It helped to provide a more structured way to create web content.

4. HTML 3.2 (1997): This version introduced support for style sheets, tables, and scripting languages like JavaScript. It was a significant step towards more complex and interactive web pages.

5. HTML 4.0 (1997): HTML 4.0 introduced improvements such as better support for multimedia and scripting, as well as the separation of content (HTML) from presentation (CSS). It had several revisions, including HTML 4.01 (1999) which refined the standard.

6. XHTML 1.0 (2000): XHTML (Extensible Hypertext Markup Language) was introduced as a reformulation of HTML 4.01 using XML (eXtensible Markup Language). It aimed to enforce stricter syntax rules, which made the markup more consistent and machine-readable.

7. HTML5 (2014): HTML5 was a major revision that brought many new features and improvements. It included new elements for handling multimedia (like `<audio>` and `<video>`), semantic elements (like `<header>`, `<footer>`, and `<article>`), and improved support for web applications (like local storage and offline capabilities). HTML5 also emphasized backward compatibility and better integration with CSS and JavaScript.

8. HTML Living Standard (ongoing): The HTML Living Standard, maintained by the Web Hypertext Application Technology Working Group (WHATWG), represents a continuous update to HTML. It incorporates ongoing improvements and new features, ensuring that HTML evolves alongside modern web technologies.

Throughout its history, HTML has continuously evolved to accommodate the changing needs of web developers and users, becoming more robust and versatile as the web has grown.

Python Coding Bad Habits

While Python is a versatile and forgiving language, developers can sometimes develop bad habits that may lead to code that is harder to maintain, understand, or debug. Here are some common bad habits in Python coding:

1. Ignoring PEP 8 Guidelines:

   PEP 8 is the style guide for Python code. Ignoring its recommendations can lead to inconsistent and hard-to-read code. Following the guidelines helps maintain a standard style across projects.

2. Not Using Meaningful Variable Names:

   Using single-letter variable names or names that don't convey the purpose of the variable can make the code less readable. Aim for descriptive and meaningful variable names.

3. Overusing Global Variables:

   Relying heavily on global variables can make the code less modular and harder to understand. Use function arguments and return values to pass information between functions.

4. Nested Loops and Functions:

   Excessive nesting of loops and functions can make the code complex and difficult to follow. It's generally a good practice to keep the nesting level to a minimum.

5. Not Handling Exceptions Properly:

   Ignoring or not handling exceptions can lead to unexpected errors and make debugging challenging. Always use try-except blocks to handle potential exceptions gracefully.

6. Hardcoding Values:

   Avoid hardcoding values directly into the code. Use constants or configuration files to store such values, making the code more flexible and easier to maintain.\

7. Ignoring Comments:

   Lack of comments or poorly written comments can make it difficult for others (or even yourself) to understand the code. Document your code with clear and concise comments.

8. Long Functions and Classes:

   Functions and classes that are too long can be difficult to understand. Break them into smaller, more manageable pieces with clear responsibilities.

9. Not Using Virtual Environments:

   Neglecting to use virtual environments can lead to conflicts between project dependencies. Always use virtual environments to isolate project dependencies.

10. Not Writing Unit Tests:

    Failing to write unit tests can result in undetected bugs and make it harder to refactor code. Develop the habit of writing tests alongside your code to ensure its correctness.

11. Ignoring Memory and Performance:

    Disregarding memory usage and performance considerations can lead to inefficient code. Be mindful of algorithms and data structures, and optimize when necessary.

12. Lack of Version Control:

    Not using version control, such as Git, can make it challenging to track changes and collaborate with others. Always use version control to manage your codebase.

By avoiding these bad habits and following best practices, you can write cleaner, more maintainable, and more understandable Python code.

What is a "Microservice"?

A microservice is a software architectural style that structures an application as a collection of small, independent services. Each microservice is designed to perform a specific business capability and communicates with other services through well-defined APIs (Application Programming Interfaces). The goal of microservices architecture is to break down a monolithic application into smaller, more manageable services that can be developed, deployed, and scaled independently.

Key characteristics of microservices include:

1. Independence: Each microservice operates independently of others, both in terms of development and deployment. This allows teams to work on different services simultaneously, using different technologies if needed.

2. Scalability: Microservices can be scaled independently based on demand for specific services, rather than having to scale an entire monolithic application.

3. Resilience: If one microservice fails, it doesn't necessarily bring down the entire application. The failure is contained to that specific service.

4. Flexibility: Microservices can be developed and deployed using different technologies, which is beneficial for choosing the right tool for the job.

5. Maintainability: Because each microservice is focused on a specific business capability, it is often easier to understand, maintain, and update.

6. Autonomy: Teams responsible for different microservices can work autonomously, making it easier to manage and scale development efforts.

However, adopting a microservices architecture also introduces challenges, such as managing inter-service communication, dealing with distributed data management, and ensuring consistency across services. Organizations need to carefully consider whether the benefits of microservices align with their specific requirements and the complexity they are willing to manage.

Architecting Inter Service Messaging

Designing an effective inter-service messaging architecture is crucial for building scalable, reliable, and maintainable distributed systems. Here are some key considerations and best practices for architecting inter-service messaging:

 1. Message Brokers:

   - Choose the Right Broker: Select a message broker that aligns with your system requirements. Popular choices include RabbitMQ, Apache Kafka, and Amazon SQS.

   - Scalability: Ensure that the message broker can scale horizontally to handle increasing loads.

   - Durability: Choose a broker that provides message persistence to prevent data loss in case of failures.

 2. Message Formats:

   - Use a Standard Format: Adopt a standard message format like JSON or Protocol Buffers for better interoperability.

   - Versioning: Include version information in messages to handle backward and forward compatibility.

 3. Communication Protocols:

   - RESTful APIs: For synchronous communication between services.

   - Asynchronous Messaging: For decoupling services and improving scalability.

   - GraphQL: Consider GraphQL for more flexible and efficient query capabilities.

 4. Service Contracts:

   - Define Clear Interfaces: Clearly define the contracts between services, including message formats, endpoints, and protocols.

   - Versioning: Plan for backward-compatible changes to avoid breaking existing consumers.

 5. Error Handling:

   - Dead Letter Queues: Implement dead letter queues to handle failed messages and diagnose issues.

   - Retry Mechanisms: Incorporate retry mechanisms with exponential backoff to handle transient failures.

 6. Service Discovery:

   - Dynamic Discovery: Utilize service discovery mechanisms to dynamically locate and communicate with services.

   - Load Balancing: Implement load balancing for distributing traffic among instances of a service.

 7. Security:

   - Encryption: Use encryption for messages, especially if sensitive information is being transmitted.

   - Authentication and Authorization: Implement strong authentication and authorization mechanisms to control access to services.

 8. Monitoring and Logging:

   - Instrumentation: Implement proper instrumentation for monitoring message flow and service interactions.

   - Centralized Logging: Centralize logs to facilitate troubleshooting and debugging.

 9. Testing:

   - Mocking: Use message mocking for testing interactions between services in isolation.

   - Integration Testing: Perform thorough integration testing to ensure smooth communication between services.

 10. Performance Optimization:

   - Batching: Consider batching multiple messages into a single payload to reduce overhead.

   - Caching: Implement caching mechanisms to reduce redundant requests between services.

 11. Documentation:

   - API Documentation: Maintain comprehensive documentation for service APIs and message formats.

   - Communication Guidelines: Document best practices and guidelines for communication between services.

 12. Monitoring and Metrics:

   - Health Checks: Implement health checks for services to identify and respond to issues proactively.

   - Metrics Collection: Collect and analyze metrics to gain insights into system performance and behavior.

By considering these factors and best practices, you can create a robust inter-service messaging architecture that promotes scalability, reliability, and maintainability in your distributed system.

JavaScript: Evolution & Impact

JavaScript is a high-level, dynamic, interpreted programming language that is widely used for both client-side and server-side web development. Here's a brief history of JavaScript:

1. Early Days (1995):

   - JavaScript was created by Brendan Eich while he was working at Netscape Communications Corporation. It was originally developed under the name Mocha, which was later changed to LiveScript, and finally, JavaScript.

   - The language was introduced in Netscape Navigator 2.0 in December 1995. It was designed to provide a way to add interactivity to web pages in the form of client-side scripts.

2. ECMAScript Standardization (1997):

   - Due to the growing popularity of JavaScript and the need for a standardized version, Netscape submitted the language to the European Computer Manufacturers Association (ECMA) for standardization.

   - The first edition of the ECMAScript standard (ECMAScript 1.0) was published in June 1997, providing a foundation for JavaScript implementations.

3. Browser Wars and DOM (1996-2000):

   - During the late 1990s, Microsoft introduced JScript as part of Internet Explorer, creating competition with Netscape's JavaScript.

   - Despite differences in implementation, efforts were made to standardize the Document Object Model (DOM) for interacting with HTML documents, leading to greater consistency in web development.

4. ECMAScript 3 (1999):

   - ECMAScript 3, released in 1999, brought significant improvements and became widely adopted across browsers. It solidified many features that are still fundamental to JavaScript today.

5. Ajax and Web 2.0 (Early 2000s):

   - In the early 2000s, JavaScript gained prominence with the advent of Ajax (Asynchronous JavaScript and XML). This allowed web pages to update content asynchronously, providing a smoother user experience.

6. ECMAScript 5 (2009):

   - ECMAScript 5, released in December 2009, introduced important features like strict mode, JSON support, and methods for working with arrays and objects. It further enhanced the language's capabilities.

7. Node.js (2009):

   - Ryan Dahl released Node.js, a server-side JavaScript runtime, in 2009. This allowed developers to use JavaScript for both client-side and server-side programming, unifying web development.

8. ECMAScript 6 (2015):

   - Also known as ES6 or ECMAScript 2015, this version introduced significant enhancements to the language, including arrow functions, template literals, classes, and let/const declarations.

9. Modern JavaScript (2016 Onward):

   - Subsequent ECMAScript versions, released annually, introduced further improvements, such as async/await, spread/rest operators, and additional features to enhance JavaScript's expressiveness and developer productivity.

10. WebAssembly (2017):

    - WebAssembly (Wasm) became a new standard for web development, enabling languages other than JavaScript (like C, C++, and Rust) to be compiled and run in web browsers at near-native speed.

11. Frameworks and Libraries:

    - The rise of popular JavaScript frameworks and libraries, such as Angular, React, and Vue.js, has played a crucial role in simplifying and organizing the development of complex web applications.

JavaScript has evolved into a versatile and powerful language, playing a central role in the development of modern web applications and technologies. Its continued growth and development are driven by the dynamic needs of the web development community. 

Java and JavaScript Naming Problem

The naming similarity between Java and JavaScript is a historical artifact. When Netscape was developing JavaScript, Java was gaining popularity, and the marketing team decided to incorporate "Java" into the name to capitalize on Java's success. However, the two languages are fundamentally different in terms of design, use cases, and execution environments. 

To summarize, Java and JavaScript share a name, but they are distinct languages with different purposes and use cases. Developers should be cautious not to confuse the two, as they require different skill sets and are used in different contexts.

Python Operators

In Python, operators are special symbols or keywords used to perform various operations on variables, values, or expressions. Python provides a wide range of operators, including arithmetic operators, comparison operators, logical operators, assignment operators, and more. Here are some of the most commonly used Python operators:

1. Arithmetic Operators:

   - Addition: `+`

   - Subtraction: `-`

   - Multiplication: `*`

   - Division: `/`

   - Floor Division (integer division): `//`

   - Modulus (remainder): `%`

   - Exponentiation: `**`

Example:...

2. Comparison Operators:   

   - Equal to: `==`

   - Not equal to: `!=`

   - Greater than: `>`

   - Less than: `<`

   - Greater than or equal to: `>=`

   - Less than or equal to: `<=`

Example:

3. Logical Operators:

   - Logical AND: `and`

   - Logical OR: `or`

   - Logical NOT: `not`

Example:

4. Assignment Operators:

   - Assignment: `=`

   - Add and assign: `+=`

   - Subtract and assign: `-=`

   - Multiply and assign: `*=`

   - Divide and assign: `/=`

   - Modulus and assign: `%=`

   - Floor divide and assign: `//=`

   - Exponentiate and assign: `**=`

Example:

5. Identity Operators:

   - `is`: Returns `True` if both operands are the same object.

   - `is not`: Returns `True` if both operands are not the same object.

Example:

6. Membership Operators:

   - `in`: Returns `True` if a value is found in a sequence (e.g., list, tuple, string).

   - `not in`: Returns `True` if a value is not found in a sequence.

Example:

7. Bitwise Operators (for working with binary numbers):

   - Bitwise AND: `&`

   - Bitwise OR: `|`

   - Bitwise XOR: `^`

   - Bitwise NOT: `~`

   - Left shift: `<<`

   - Right shift: `>>`

These operators are used for low-level operations and are less commonly used in everyday Python programming.

These are the basic operators in Python, but there are more operators and nuances to explore as you delve deeper into Python programming. Operators are fundamental for performing calculations, making decisions, and manipulating data in your Python programs.

Review: A Cloud Guru

A Cloud Guru is an online learning platform that specializes in providing training and courses for cloud computing and DevOps. My general review of A Cloud Guru based on using their service for the past three years.

Pros of A Cloud Guru:

1. Specialized Content: A Cloud Guru focuses on cloud computing, AWS, Azure, Google Cloud, and DevOps. It provides in-depth training and courses in these areas, making it a valuable resource for individuals and businesses looking to enhance their cloud-related skills.

2. Hands-On Labs: The platform offers hands-on labs and practical exercises, which can be crucial for learning and mastering cloud technologies. These labs allow you to apply your knowledge in a real-world environment.

3. Certification Preparation: A Cloud Guru's courses are designed to prepare individuals for various cloud certification exams, such as AWS Certified Solutions Architect, Azure Administrator, and more. They often provide content specifically tailored to the objectives of these exams.

4. Community and Support: A Cloud Guru has an active community and discussion forums where you can ask questions, seek help, and connect with other learners. They also offer support through various channels, including email and chat.

5. Interactive Learning: The platform uses a mix of video lessons, quizzes, and hands-on labs to engage learners, providing a dynamic and interactive learning experience.

6. Accessibility: A Cloud Guru's courses are accessible online, allowing you to learn at your own pace and from anywhere with an internet connection. They also offer mobile apps for learning on the go.

Cons of A Cloud Guru:

1. Limited Subject Matter: A Cloud Guru primarily focuses on cloud computing and DevOps, which may not be suitable if you're looking for a broader range of IT or programming topics.

2. Outdated Content: As technology evolves rapidly, some of the content on A Cloud Guru may become outdated. It's important to check for updates and ensure that you're learning the most current information.

3. Pricing: While A Cloud Guru offers a free trial, the platform is subscription-based, and the cost of their courses can be relatively high compared to other online learning platforms. However, this cost may be justified for professionals seeking specific cloud-related certifications.

4. Not Ideal for Complete Beginners: Some courses assume a basic level of knowledge in cloud computing or related areas, so complete beginners may find it challenging to start with A Cloud Guru.

Please note that the platform may have evolved and changed since my last update in 2022, so I recommend checking their official website for the most up-to-date information and user reviews to make an informed decision about whether A Cloud Guru is the right choice for your learning needs.

Python Geolocation Tools

Geolocation in Python refers to the process of determining the geographic location of a device or user based on their IP address, GPS coordinates, or other available data sources. Python provides several libraries and APIs for geolocation services. Here are some common ways to work with geolocation in Python:

1. Geocoding and Reverse Geocoding with Geopy:

   - Geopy is a Python library that provides easy access to various geocoding services and can also perform reverse geocoding. You can use it to convert between addresses (geocoding) and coordinates (reverse geocoding).

Install Geopy using pip:

   Here's a basic example of geocoding and reverse geocoding with Geopy:

2. IP Geolocation with the "requests" library:

   You can use various IP geolocation APIs to obtain information about the geographic location of an IP address. One such service is the "ipinfo.io" API. You can make HTTP requests to this API using the "requests" library in Python.

Install requests using pip:

Here's an example of using the "ipinfo.io" API to get geolocation information for an IP address:

3. Using GeoIP databases:

   Another way to perform IP geolocation is by using GeoIP databases like MaxMind's GeoIP2. You can install the GeoIP2 Python library and download the GeoIP2 database for accurate IP geolocation.

Install the GeoIP2 library using pip:

Here's an example of using the GeoIP2 library to perform IP geolocation:

These are some common methods to perform geolocation in Python. The specific method you choose will depend on your use case and the data sources available to you.

About Data Scraping

Data scraping, also known as web scraping, is a technique used to extract information or data from websites or online sources. It involves automatically retrieving and collecting data from web pages, typically in an unstructured or semi-structured format, and then converting it into a more structured format for analysis, storage, or other purposes. Data scraping can be done manually, but it is more commonly performed using software tools or scripts to automate the process.

The process of data scraping typically involves the following steps:

1. Sending HTTP Requests: Scraping tools or scripts send HTTP requests to specific URLs, just like a web browser does when you visit a website.=

2. Downloading Web Pages: The HTML content of the web pages is downloaded in response to the HTTP requests.

3. Parsing HTML: The downloaded HTML is then parsed to extract the specific data of interest, such as text, images, links, or tables.

4. Data Extraction: The desired data is extracted from the parsed HTML. This can involve locating specific elements in the HTML code using techniques like XPath or CSS selectors.

5. Data Transformation: The extracted data is often cleaned and transformed into a structured format, such as a CSV file, database, or JSON, for further analysis.

Data scraping can be used for a wide range of purposes, including:

- Competitive analysis: Gathering data on competitors' prices, products, or strategies.

- Market research: Collecting data on market trends, customer reviews, or product information.

- Lead generation: Extracting contact information from websites for potential sales or marketing leads.

- News and content aggregation: Gathering news articles, blog posts, or other content from various sources.

- Price monitoring: Keeping track of price changes for e-commerce products.

- Data analysis and research: Collecting data for research and analysis purposes.

It's important to note that while data scraping can be a valuable tool for data collection and analysis, it should be done responsibly and in compliance with legal and ethical considerations. Many websites have terms of service that prohibit scraping, and there may be legal restrictions on the types of data that can be collected. Always respect website terms and conditions, robots.txt files, and applicable data protection laws when performing data scraping.

Shakespeare and the Hiring Process

Mid-summer of the year 2000, after the excitement of the Subway Series I was finishing up a programming project which took a set of code built by George Washington University called "Blackboard" and retrofit it to build NYUOnline.com.

It was a great gig, but the working conditions kinda sucked.  My desk was more-or-less in a hallway between the operations office and their sales office with the door leading to the elevator behind me. And it wasn't really a desk, it was one of those small reading tables you might find in a library. If I was going to use a reference book or read some of the Blackboard documentation I had to put my keyboard on top of the monitor.

The location was a perfect place to learn about 'The Big Apple'. It was on the 500 block of Broadway, NY which is between Houston (pronounced 'how-ston') and Canal Streets which put me right in the middle SOHO near the neighborhoods of China Town and Little Italy. It is this area of the city where at 5 p.m. the sidewalks are packed shoulder to shoulder with people trying to get to their train or bus so they can go home.

Regardless of the working conditions I had to stick-it-out, I rented a house on Staten Island having made the move from Taylorsville, NC.

At the end of 2000 the "dot.com" bubble was about to burst and NYU decided to take the endeavor in-house, reducing the funding. When they had released half of their sales and operational staff I saw the writing on the wall and went to Monster.com to find another ColdFusion position in New York City.

I had two job offers fairly quickly. ColdFusion programmers who can also do database work (now called "full-stack" developers) were a rare breed back then. It was only a couple of days before I had two interviews both of which turned into job offers.

The first was MarthaStewart.com. This was the time when Martha was at the top of her game and a full three years before she reported for a five-month term in federal prison for lying to federal investigators. They had a large staff working on her web presence, the offices were nice and fully decorated as an homage to Martha with pictures of her and food too pretty to eat.

The other was LAWTRAC.com. Their offices were on the eleventh floor of an office building on Montague Street in Brooklyn.  Here I would be the only programmer taking an older application and converting it to a web-based offering.

With both offers being exactly the same dollar wise the choice was easy. I went to work for LAWTRAC where I would be 'the guy' with, more-or-less, a free hand to simply develop.

For the next fourteen years I was 'the guy'. Not only did I do all the application programming, but I designed the database, made the hosting and delivery decisions, added modules and functionality that no one in our industry of matter management software for corporate legal departments had or were even close to having.

I was in Hog's Heaven, working most of the time from my house on Staten Island, then moving to Brooklyn after a stabbing incident (another story) and finally to a neighborhood on Long Island called Carle Place.

I was fully engulfed in ColdFusion and database programming and the world of corporate legal needs and using the programming to meet those needs. I traveled the country doing product demos, working with customers, tradeshows and had speaking engagements on both corporate legal data management and ColdFusion programming techniques.

By 2009 we had hired two additional programmers. One had a focus on creating custom reports for clients and the other's forte was writing the data exchange packages so the legal and financial data could talk to other programs.

Life was great - I was THE big fish in a little pond, making great money and had earned five-percent ownership in the company, a reward for sticking around during the lean times when the company was struggling.

By the time we received our buy-out offer from Mitratech and Vista Equity Partners the software industry had completely recovered from the 'Dot.com' downturn. This recovery period ushered in more structure to the methodologies software companies were using to produce their products. The older method called "Waterfall" turned to piece-meal structure called "Agile". The industry incorporated things called Product Managers who worked with the clients to identify needed changes to continue to meet client needs. The Agile methodology also used positions called Scrum Masters who took the needed changes and broke the requirements down so the changes could be done in a structured, more modular method.

A far cry from what we at Lawtrac were doing. After all, with a programming staff of three we didn't need all that additional overhead because I was doing all the things Product Managers, Project Managers, and Scrum Masters were doing. And we were doing fine, we had clients like Oprah, United Technologies, all the major oil companies, health care equipment providers, Federal Express, even the American Bar Association used our software to track their legal matters.

The American Bar Association, getting them as a client was like getting the contract to provide the candles to the Vatican. To this day I don't understand why the new owners haven't leveraged that to boost their sales.

Mitratech is a 'best practices' company using the Agile method to produce software. So quickly I had to adapt; I took classes on Lynda.com, bought books from Amazon and by February of 2014 I was up to speed and had brought the Lawtrac development and support staff up to speed as well.

I realize now that during the time I was the 'big fish' writing the software I did so in a bubble. My world consisted of writing code, caring for customer needs, speaking at conferences, doing trade shows, generally helping to enrich my meager five-percent ownership. The industry of software production had introduced business processes I was unaware of and the handing-over of Lawtrac source code to Mitratech felt like landing on the moon.

But I had helped to build a software company. I fought the good fight and afterwards walked away with enough money to buy and furnish a house in Austin, TX. I moved there thinking that I would fit in at Mitratech and could continue working on what was more-or-less my baby and help it grow even more.

I eventually had to resign because the person at Mitratech (VP of Product Development) removed me from the role of being a programmer who worked with clients to continue to build a better product had placed me in a role of doing nothing more than support ticket changes and handed the day-to-day programming tasks to complete strangers.

Three years have gone buy, I'm still trying to fit in where I can use the ColdFusion and database programming skills I have to earn a living.

But I'm finding that software companies don't want learned programmers. The conventional hiring practice follows the acronym "HIPLE" which stands for 'High Potential, Low Experience'. Recently I interviewed with a company which does corporate patent and trademark software (which would be right up my ally) called iRunWay and they actually said during the interview that they were concerned how I would fit in with a staff made up of all younger people. Two months ago, I meet with a company called CoStar; I had gone through four interviews before they meet me in person and I guarantee you that the only reason they rejected me was my greying hair. I'm still getting calls from recruiters about that position, CoStar had no other reason to reject me.

Since leaving Mitratech I've worked to bring my skills up-to-date taking courses for my Project Manager Professional certificate and Amazon Web Services Architect certification.

Getting past the young recruiter staff software companies employ too has been a challenge. If I remove much of my work experience and the dates from my resume so my age is not as apparent I get calls, but once they begin to since I'm over thirty those calls go downhill very quickly.

The whole experience reminds me of Shakespeare's St. Crispin's Day Speech, the ending….

And gentlemen in England now a-bed
Shall think themselves accurs'd they were not here,
And hold their manhoods cheap whiles any speaks

Of all the start-up companies in Austin, TX you would think that one would like to have a seasoned programmer who would bring a 'been there, done that' attitude. One that has experienced programming pit-falls many on their HIPLE staffs will make.

But I really think Shakespeare was onto something. A recruiter or young hiring manager looks over my resume they experience their own feelings of having missed out on something, like the birth of the Internet and that history that has lead up to what the industry is today.


@TheCoStarGroup
@iRunwayInc

ColdFusion is NOT Dead

Inside the Modern ColdFusion Platform

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in several products. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system.
Users and administrators are encouraged to review the following Cisco Security Advisories and apply the necessary updates:

• Cisco Web Security Appliance HTTP Load Denial of Service Vulnerability cisco-sa-20160914-wsa (link is external)
• Cisco WebEx Meetings Server Denial of Service Vulnerability cisco-sa-20160914-wms (link is external)
• Cisco WebEx Meetings Server Remote Command Execution Vulnerability cisco-sa-20160914-wem (link is external)
• Cisco Unified Computing System Command Line Interface Privilege Escalation Vulnerability cisco-sa-20160914-ucs (link is external)
• Cisco Fog Director for IOx Arbitrary File Write Vulnerability cisco-sa-20160914-ioxfd (link is external)
• Cisco IOS XR for NCS6000 Series Devices OSPF Packet Processing Denial of Service Vulnerability cisco-sa-20160914-iosxr (link is external)
• Cisco IOS and IOS XE Software Data in Motion Denial of Service Vulnerability cisco-sa-20160914-ios-xe (link is external)
• Cisco IOS and IOS XE Software IOx Local Manager Cross-Site Scripting Vulnerability cisco-sa-20160914-ios (link is external)
• Cisco Carrier Routing System IPv6 Denial of Service Vulnerability cisco-sa-20160914-crs

Source: https://www.us-cert.gov/ncas/current-activity/2016/09/15/Cisco-Releases-Security-Updates

Ransomware

Source: https://www.us-cert.gov/ncas/alerts/TA16-091A

Ransomware and Recent Variants

Overview

In early 2016, destructive ransomware variants such as Locky and Samas were observed infecting computers belonging to individuals and businesses, which included healthcare facilities and hospitals worldwide. Ransomware is a type of malicious software that infects a computer and restricts users’ access to it until a ransom is paid to unlock it.
The United States Department of Homeland Security (DHS), in collaboration with Canadian Cyber Incident Response Centre (CCIRC), is releasing this Alert to provide further information on ransomware, specifically its main characteristics, its prevalence, variants that may be proliferating, and how users can prevent and mitigate against ransomware.

Description

WHAT IS RANSOMWARE?

Ransomware is a type of malware that infects computer systems, restricting users’ access to the infected systems. Ransomware variants have been observed for several years and often attempt to extort money from victims by displaying an on-screen alert. Typically, these alerts state that the user’s systems have been locked or that the user’s files have been encrypted. Users are told that unless a ransom is paid, access will not be restored. The ransom demanded from individuals varies greatly but is frequently $200–$400 dollars and must be paid in virtual currency, such as Bitcoin.
Ransomware is often spread through phishing emails that contain malicious attachments or through drive-by downloading. Drive-by downloading occurs when a user unknowingly visits an infected website and then malware is downloaded and installed without the user’s knowledge.
Crypto ransomware, a malware variant that encrypts files, is spread through similar methods and has also been spread through social media, such as Web-based instant messaging applications. Additionally, newer methods of ransomware infection have been observed. For example, vulnerable Web servers have been exploited as an entry point to gain access into an organization’s network.

WHY IS IT SO EFFECTIVE?

The authors of ransomware instill fear and panic into their victims, causing them to click on a link or pay a ransom, and users systems can become infected with additional malware. Ransomware displays intimidating messages similar to those below:

• “Your computer has been infected with a virus. Click here to resolve the issue.”
• “Your computer was used to visit websites with illegal content. To unlock your computer, you must pay a $100 fine.”
• “All files on your computer have been encrypted. You must pay this ransom within 72 hours to regain access to your data.”

PROLIFERATION OF VARIANTS

In 2012, Symantec, using data from a command and control (C2) server of 5,700 computers compromised in one day, estimated that approximately 2.9 percent of those compromised users paid the ransom. With an average ransom of $200, this meant malicious actors profited $33,600 per day, or $394,400 per month, from a single C2 server. These rough estimates demonstrate how profitable ransomware can be for malicious actors.
This financial success has likely led to a proliferation of ransomware variants. In 2013, more destructive and lucrative ransomware variants were introduced, including Xorist, CryptorBit, and CryptoLocker. Some variants encrypt not just the files on the infected device, but also the contents of shared or networked drives. These variants are considered destructive because they encrypt users’ and organizations’ files, and render them useless until criminals receive a ransom.
In early 2016, a destructive ransomware variant, Locky, was observed infecting computers belonging to healthcare facilities and hospitals in the United States, New Zealand, and Germany. It propagates through spam emails that include malicious Microsoft Office documents or compressed attachments (e.g., .rar, .zip). The malicious attachments contain macros or JavaScript files to download Ransomware-Locky files.
Samas, another variant of destructive ransomware, was used to compromise the networks of healthcare facilities in 2016. Unlike Locky, Samas propagates through vulnerable Web servers. After the Web server was compromised, uploaded Ransomware-Samas files were used to infect the organization’s networks.

LINKS TO OTHER TYPES OF MALWARE

Systems infected with ransomware are also often infected with other malware. In the case of CryptoLocker, a user typically becomes infected by opening a malicious attachment from an email. This malicious attachment contains Upatre, a downloader, which infects the user with GameOver Zeus. GameOver Zeus is a variant of the Zeus Trojan that steals banking information and is also used to steal other types of data. Once a system is infected with GameOver Zeus, Upatre will also download CryptoLocker. Finally, CryptoLocker encrypts files on the infected system, and requests that a ransom be paid.
The close ties between ransomware and other types of malware were demonstrated through the recent botnet disruption operation against GameOver Zeus, which also proved effective against CryptoLocker. In June 2014, an international law enforcement operation successfully weakened the infrastructure of both GameOver Zeus and CryptoLocker.

Impact

Ransomware not only targets home users; businesses can also become infected with ransomware, leading to negative consequences, including

• temporary or permanent loss of sensitive or proprietary information,
• disruption to regular operations,
• financial losses incurred to restore systems and files, and
• potential harm to an organization’s reputation.

Paying the ransom does not guarantee the encrypted files will be released; it only guarantees that the malicious actors receive the victim’s money, and in some cases, their banking information. In addition, decrypting files does not mean the malware infection itself has been removed.

Solution

Infections can be devastating to an individual or organization, and recovery can be a difficult process that may require the services of a reputable data recovery specialist.
US-CERT recommends that users and administrators take the following preventive measures to protect their computer networks from ransomware infection:

• Employ a data backup and recovery plan for all critical information. Perform and test regular backups to limit the impact of data or system loss and to expedite the recovery process. Note that network-connected backups can also be affected by ransomware; critical backups should be isolated from the network for optimum protection.
• Use application whitelisting to help prevent malicious software and unapproved programs from running. Application whitelisting is one of the best security strategies as it allows only specified programs to run, while blocking all others, including malicious software.
• Keep your operating system and software up-to-date with the latest patches. Vulnerable applications and operating systems are the target of most attacks. Ensuring these are patched with the latest updates greatly reduces the number of exploitable entry points available to an attacker.
• Maintain up-to-date anti-virus software, and scan all software downloaded from the internet prior to executing.
• Restrict users’ ability (permissions) to install and run unwanted software applications, and apply the principle of “Least Privilege” to all systems and services. Restricting these privileges may prevent malware from running or limit its capability to spread through the network.
• Avoid enabling macros from email attachments. If a user opens the attachment and enables macros, embedded code will execute the malware on the machine. For enterprises or organizations, it may be best to block email messages with attachments from suspicious sources. For information on safely handling email attachments, see Recognizing and Avoiding Email Scams. Follow safe practices when browsing the Web. See Good Security Habits and Safeguarding Your Data for additional details.
• Do not follow unsolicited Web links in emails. Refer to the US-CERT Security Tip on Avoiding Social Engineering and Phishing Attacks or the Security Publication on Ransomware for more information.

Individuals or organizations are discouraged from paying the ransom, as this does not guarantee files will be released. Report instances of fraud to the FBI at the Internet Crime Complaint Center.

References

• Kaspersky Lab, Kaspersky Lab detects mobile Trojan Svpeng: Financial malware with ransomware capabilities now targeting U.S. (link is external)
• Sophos / Naked Security, What’s next for ransomware? CryptoWall picks up where CryptoLocker left off (link is external)
• Symantec, CryptoDefence, the CryptoLocker Imitator, Makes Over $34,000 in One Month (link is external)
• Symantec, Cryptolocker: A Thriving Menace (link is external)
• Symantec, Cryptolocker Q&A: Menace of the Year (link is external)
• Symantec, International Takedown Wounds Gameover Zeus Cybercrime Network (link is external)
• Sophos / Naked Security, “Locky” ransomware – what you need to know (link is external)
• McAfee Labs Threat Advisory: Ransomware-Locky. March 9, 2016 (link is external)
• SamSam: The Doctor Will See You, After He Pays The Ransom (link is external)

Revisions

• March 31, 2016: Initial publication
• May 6, 2016: Clarified guidance on offline backups
• July 11, 2016: Added link to governmental interagency guidance on ransomware

MySQL Users - Update Your Servers Now

Source: Oracle


Oracle kind-a 'hid' the fact that some major security vulnerabilities were found in their MySQL product by listing the effected versions way at the bottom of their Critical Patch Advisory for April 2016.

From Oracle:

Description

A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security fixes. Please refer to:

Critical Patch Updates and Security Alerts for information about Oracle Security Advisories.

Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released fixes. In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply Critical Patch Update fixes without delay.

This Critical Patch Update contains 136 new security fixes across the product families listed below. Please note that a blog entry summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at https://blogs.oracle.com/security.

Please note that on March 23, 2016, Oracle released Security Alert for Java SE for CVE-2016-0636. Customers of affected Oracle product(s) are strongly advised to apply the fixes that were announced for CVE-2016-0636.

Please also note that the vulnerabilities in this Critical Patch Update are scored using versions 3.0 and 2.0 of Common Vulnerability Scoring Standard (CVSS). Future Critical Patch Updates and Security Alerts will be scored using CVSS version 3.0 only.

This Critical Patch Update advisory is also available in an XML format that conforms to the Common Vulnerability Reporting Format (CVRF) version 1.1. More information about Oracle's use of CVRF is available here.

Urgent - Uninstall Quick Time

REF: US-CERT

Apple Ends Support for QuickTime for Windows; New Vulnerabilities Announced

   

Systems Affected

Microsoft Windows with Apple QuickTime installed

Overview

According to Trend Micro, Apple will no longer be providing security updates for QuickTime for Windows, leaving this software vulnerable to exploitation. [1] (link is external)

Description

All software products have a lifecycle. Apple will no longer be providing security updates for QuickTime for Windows. [1] (link is external)
The Zero Day Initiative has issued advisories for two vulnerabilities found in QuickTime for Windows. [2] (link is external) [3] (link is external)

Impact

Computer systems running unsupported software are exposed to elevated cybersecurity dangers, such as increased risks of malicious attacks or electronic data loss. Exploitation of QuickTime for Windows vulnerabilities could allow remote attackers to take control of affected systems.

Solution

Computers running QuickTime for Windows will continue to work after support ends. However, using unsupported software may increase the risks from viruses and other security threats. Potential negative consequences include loss of confidentiality, integrity, or availability of data, as well as damage to system resources or business assets. The only mitigation available is to uninstall QuickTime for Windows. Users can find instructions for uninstalling QuickTime for Windows on the Apple Uninstall QuickTime (link is external) page. [4]

References

• [1] Trend Micro - Urgent Call to Action: Uninstall QuickTime for Windows Today (link is external)
• [2] Zero Day Initiative Advisory ZDI 16-241: (0Day) Apple QuickTime moov Atom Heap Corruption Remote Code Execution Vulnerabilit (link is external)
• [3] Zero Day Initiative Advisory ZDI 16-242: (0Day) Apple QuickTime Atom Processing Heap Corruption Remote Code Execution Vulner (link is external)
• [4] Apple - Uninstall QuickTime 7 for Windows

FTC Alert: Tech-Support Scams

Source: US-CERT

The Federal Trade Commission (FTC) has released an alert on tech-support themed telephone scams. In these schemes, fraudulent callers claim to be from legitimate technical support organizations and offer to fix computer problems that don't exist. Users should not give control of their computers to anyone who calls offering to "fix" a problem.

By: Andrew Johnson 
Division of Consumer and Business Education, FTC

There’s a new twist on tech-support scams — you know, the one where crooks try to get access to your computer or sensitive information by offering to “fix” a computer problem that doesn’t actually exist. Lately, we’ve heard reports that people are getting calls from someone claiming to be from the Global Privacy Enforcement Network. Their claim? That your email account has been hacked and is sending fraudulent messages. They say they’ll have to take legal action against you, unless you let them fix the problem right away.

If you raise questions, the scammers turn up the pressure – but they’ve also given out phone numbers of actual Federal Trade Commission staff (who have been surprised to get calls). The scammers also have sent people to the actual website for the Global Privacy Enforcement Network. (It’s a real thing: it’s an organization that helps governments work together on cross-border privacy cooperation.)

Here are few things to remember if you get any kind of tech-support call, no matter who they say they are:

• Don’t give control of your computer to anyone who calls you offering to “fix” your computer.
• Never give out or confirm your financial or sensitive information to anyone who contacts you.
• Getting pressure to act immediately? That’s a sure sign of a scam. Hang up.
• If you have concerns, contact your security software company directly. Use contact information you know is right, not what the caller gives you.

Ransomware and Recent Variants

Source: US_CERT

WHAT IS RANSOMWARE?

Ransomware is a type of malware that infects computer systems, restricting users’ access to the infected systems. Ransomware variants have been observed for several years and often attempt to extort money from victims by displaying an on-screen alert. Typically, these alerts state that the user’s systems have been locked or that the user’s files have been encrypted. Users are told that unless a ransom is paid, access will not be restored. The ransom demanded from individuals varies greatly but is frequently $200–$400 dollars and must be paid in virtual currency, such as Bitcoin.
Ransomware is often spread through phishing emails that contain malicious attachments or through drive-by downloading. Drive-by downloading occurs when a user unknowingly visits an infected website and then malware is downloaded and installed without the user’s knowledge.
Crypto ransomware, a malware variant that encrypts files, is spread through similar methods and has also been spread through social media, such as Web-based instant messaging applications. Additionally, newer methods of ransomware infection have been observed. For example, vulnerable Web servers have been exploited as an entry point to gain access into an organization’s network.

WHY IS IT SO EFFECTIVE?

The authors of ransomware instill fear and panic into their victims, causing them to click on a link or pay a ransom, and users systems can become infected with additional malware. Ransomware displays intimidating messages similar to those below:

• “Your computer has been infected with a virus. Click here to resolve the issue.”
• “Your computer was used to visit websites with illegal content. To unlock your computer, you must pay a $100 fine.”
• “All files on your computer have been encrypted. You must pay this ransom within 72 hours to regain access to your data.”

PROLIFERATION OF VARIANTS

In 2012, Symantec, using data from a command and control (C2) server of 5,700 computers compromised in one day, estimated that approximately 2.9 percent of those compromised users paid the ransom. With an average ransom of $200, this meant malicious actors profited $33,600 per day, or $394,400 per month, from a single C2 server. These rough estimates demonstrate how profitable ransomware can be for malicious actors.


This financial success has likely led to a proliferation of ransomware variants. In 2013, more destructive and lucrative ransomware variants were introduced, including Xorist, CryptorBit, and CryptoLocker. Some variants encrypt not just the files on the infected device, but also the contents of shared or networked drives. These variants are considered destructive because they encrypt users’ and organizations’ files, and render them useless until criminals receive a ransom.


In early 2016, a destructive ransomware variant, Locky, was observed infecting computers belonging to healthcare facilities and hospitals in the United States, New Zealand, and Germany. It propagates through spam emails that include malicious Microsoft Office documents or compressed attachments (e.g., .rar, .zip). The malicious attachments contain macros or JavaScript files to download Ransomware-Locky files.


Samas, another variant of destructive ransomware, was used to compromise the networks of healthcare facilities in 2016. Unlike Locky, Samas propagates through vulnerable Web servers. After the Web server was compromised, uploaded Ransomware-Samas files were used to infect the organization’s networks.

LINKS TO OTHER TYPES OF MALWARE

Systems infected with ransomware are also often infected with other malware. In the case of CryptoLocker, a user typically becomes infected by opening a malicious attachment from an email. This malicious attachment contains Upatre, a downloader, which infects the user with GameOver Zeus. GameOver Zeus is a variant of the Zeus Trojan that steals banking information and is also used to steal other types of data. Once a system is infected with GameOver Zeus, Upatre will also download CryptoLocker. Finally, CryptoLocker encrypts files on the infected system, and requests that a ransom be paid.


The close ties between ransomware and other types of malware were demonstrated through the recent botnet disruption operation against GameOver Zeus, which also proved effective against CryptoLocker. In June 2014, an international law enforcement operation successfully weakened the infrastructure of both GameOver Zeus and CryptoLocker.

Impact

Ransomware not only targets home users; businesses can also become infected with ransomware, leading to negative consequences, including

• temporary or permanent loss of sensitive or proprietary information,
• disruption to regular operations,
• financial losses incurred to restore systems and files, and
• potential harm to an organization’s reputation.

Paying the ransom does not guarantee the encrypted files will be released; it only guarantees that the malicious actors receive the victim’s money, and in some cases, their banking information. In addition, decrypting files does not mean the malware infection itself has been removed.

Solution

Infections can be devastating to an individual or organization, and recovery can be a difficult process that may require the services of a reputable data recovery specialist.
US-CERT recommends that users and administrators take the following preventive measures to protect their computer networks from ransomware infection:

• Employ a data backup and recovery plan for all critical information. Perform and test regular backups to limit the impact of data or system loss and to expedite the recovery process. Ideally, this data should be kept on a separate device, and backups should be stored offline.
• Use application whitelisting to help prevent malicious software and unapproved programs from running. Application whitelisting is one of the best security strategies as it allows only specified programs to run, while blocking all others, including malicious software.
• Keep your operating system and software up-to-date with the latest patches. Vulnerable applications and operating systems are the target of most attacks. Ensuring these are patched with the latest updates greatly reduces the number of exploitable entry points available to an attacker.
• Maintain up-to-date anti-virus software, and scan all software downloaded from the internet prior to executing.
• Restrict users’ ability (permissions) to install and run unwanted software applications, and apply the principle of “Least Privilege” to all systems and services. Restricting these privileges may prevent malware from running or limit its capability to spread through the network.
• Avoid enabling macros from email attachments. If a user opens the attachment and enables macros, embedded code will execute the malware on the machine. For enterprises or organizations, it may be best to block email messages with attachments from suspicious sources. For information on safely handling email attachments, see Recognizing and Avoiding Email Scams. Follow safe practices when browsing the Web. See Good Security Habits and Safeguarding Your Data for additional details.
• Do not follow unsolicited Web links in emails. Refer to the US-CERT Security Tip on Avoiding Social Engineering and Phishing Attacks for more information.

Individuals or organizations are discouraged from paying the ransom, as this does not guarantee files will be released. Report instances of fraud to the FBI at the Internet Crime Complaint Center.

References

• Kaspersky Lab, Kaspersky Lab detects mobile Trojan Svpeng: Financial malware with ransomware capabilities now targeting U.S. (link is external)
• Sophos / Naked Security, What’s next for ransomware? CryptoWall picks up where CryptoLocker left off (link is external)
• Symantec, CryptoDefence, the CryptoLocker Imitator, Makes Over $34,000 in One Month (link is external)
• Symantec, Cryptolocker: A Thriving Menace (link is external)
• Symantec, Cryptolocker Q&A: Menace of the Year (link is external)
• Symantec, International Takedown Wounds Gameover Zeus Cybercrime Network (link is external)
• Sophos / Naked Security, “Locky” ransomware – what you need to know (link is external)
• McAfee Labs Threat Advisory: Ransomware-Locky. March 9, 2016 (link is external)
• SamSam: The Doctor Will See You, After He Pays The Ransom

DoD Issues Cybersecurity Discipline Guidance

Source: Army Times http://www.armytimes.com/

The Defense Department recently issued a military-wide cybersecurity discipline implementation plan, a document that aims to hold leaders accountable for cybersecurity up and down the chain of command and report progress and setbacks.

The plan was originally issued in October but updated in February and made public on the DoD CIO site in early March. It shares some similarities with the Pentagon’s other large-scale cyber assessment tool, the department’s strategic cybersecurity scorecard that reports service-level compliance directly to the Defense secretary. The difference between the two is that the discipline implementation plan targets tactical-level compliance, and each has different reporting mechanisms – the discipline plan routes users to the Defense Readiness Reporting System to report their status with the requirements.

The new plan centers on four lines of effort, which actually correspond with the cybersecurity scorecard. They include:

• Strong authentication to degrade the adversaries' ability to maneuver on DoD information networks;
• Device hardening to reduce internal and external attack vectors into DoD information networks;
• Reduce attack surface to reduce external attack vectors into DoD information networks; and
• Alignment to cybersecurity/computer network defense service providers to improve detection of and response to adversary activity

"The requirements within each line of effort represent a prioritization of all existing DoD cybersecurity requirements. Each line of effort focuses on a different aspect of cybersecurity defense-in-depth that is being exploited by our adversaries to gain access to DoD information networks,” the document states. “Securing DoD information networks to provide mission assurance requires leadership at all levels to implement cybersecurity discipline, enforce accountability, and manage the shared risk to all DoD missions … this campaign forces awareness and accountability for these key tasks into the command chains and up to senior leadership, where resourcing decisions can be made to address compliance shortfalls."

Each of the four lines of effort includes a thorough explanation of the goal, followed by multiple tasks and questions designed to assess compliance, vulnerability and progress. An appendix further details prioritizes tasks from the discipline implementation and from previously issued DoD cybersecurity campaign guidance, and weights DoD’s cybersecurity objectives.

"Work on these tasks can proceed in parallel; these lists guide the application of limited resources to the most critical tasks for securing and defending segments of the network across the Department,” the document notes. “Of primary importance is implementing a healthy cybersecurity culture across all ranks, one that ingrains a self-correcting discipline similar to the nuclear enterprise or other critical, highly reliable organizations. If we fail to change the culture, we will fail to secure the enterprise regardless of any defenses installed otherwise."

Despite the use of the term ‘discipline’ in its title though, one thing the new plan seems to lack, at least in the unclassified version: consequences for failing to meet goals or maintain security. It’s not immediately clear what might happen to people who fall short of requirements or fall to cyberattacks.

IRS and US-CERT Caution Users: Prepare for Heightened Phishing Risk This Tax Season

Overview

Throughout the year, scam artists pose as legitimate entities—such as the Internal Revenue Service (IRS), other government agencies, and financial institutions—in an attempt to defraud taxpayers. They employ sophisticated phishing campaigns to lure users to malicious sites or entice them to activate malware in infected email attachments. To protect sensitive data, credentials, and payment information, US-CERT and the IRS recommend taxpayers prepare for heightened risk this tax season and remain vigilant year-round.

Remain alert

Phishing attacks use email or malicious websites to solicit personal information by posing as a trustworthy organization. In many successful incidents, recipients are fooled into believing the phishing communication is from someone they trust. An actor may take advantage of knowledge gained from research and earlier attempts to masquerade as a legitimate source, including the look and feel of authentic communications. These targeted messages can trick any user into taking action that may compromise enterprise security.

Spot common elements of the phishing lifecycle

1. A Lure: enticing email content.
   • Example 1 of actual phishing email
   • Example 2 of actual phishing email
2. A Hook: an email-based exploit.
   • Email with embedded malicious content that is executed as a side effect of opening the email
   • Email with malicious attachments that are activated as a side effect of opening an attachment
   • Email with “clickable” URLs: the body of the email includes a link, which displays as a recognized, legitimate website, though the actual URL redirects the user to malicious content
3. A Catch: a transaction conducted by an actor following a successful attempt.
   • Unexplainable charges
   • Unexplainable password changes

Understand how the IRS communicates electronically with taxpayers

• The IRS does not initiate contact with taxpayers by email, text messages or social media channels to request personal or financial information.
• This includes requests for PIN numbers, passwords or similar access information for credit cards, banks or other financial accounts.
• The official website of the IRS is www.irs.gov.

Take action to avoid becoming a victim

If you believe you might have revealed sensitive information about your organization or access credentials, report it to the appropriate contacts within the organization, including network administrators. They can be alert for any suspicious or unusual activity.
Watch for any unexplainable charges to your financial accounts. If you believe your accounts may be compromised, contact your financial institution immediately and close those accounts.
If you believe you might have revealed sensitive account information, immediately change the passwords you might have revealed. If you used the same password for multiple accounts, make sure to change the password for each account and do not use that password in the future.

Report suspicious phishing communications

• Email: If you read an email claiming to be from the IRS, do not reply or click on attachments and/or links. Forward the email as-is to phishing@irs.gov (link sends e-mail), then delete the original email.
• Website: If you find a website that claims to be the IRS and suspect it is fraudulent, send the URL of the suspicious site to phishing@irs.gov (link sends e-mail) with subject line, “Suspicious website”.
• Text Message: If you receive a suspicious text message, do not reply or click on attachments and/or links. Forward the text as-is to 202-552-1226 (standard text rates apply), and then delete the original message (if you clicked on links in SMS and entered confidential information, visit the IRS’ identity protection page).

If you are a victim of any of the above scams involving IRS impersonation, please report to phishing@irs.gov (link sends e-mail), file a report with the Treasury Inspector General for Tax Administration (TIGTA), the Federal Trade Commission (FTC), and the police.

Additional Resources

For more information on phishing, other suspicious IRS-related communications including phone or fax scams, or additional guidance released by Treasury/IRS and DHS/US-CERT, visit:

• Avoiding Social Engineering and Phishing Attacks
• Recognizing and Avoiding Email Scams
• Phishing and Other Schemes Using the IRS Name
• IRS Repeats Warning about Phone Scams
• Report Phishing and Online Scams
• Tips for Taxpayers, Victims about Identity Theft and Tax Returns

To report a cybersecurity incident, vulnerability, or phishing attempt, visit US-CERT.gov/report.

Author

US-CERT and IRS