Malware email from an external source

A Mac-based business wrote:

We potentially have a virus issue. We all received an email from a colleague stating that he was sharing a document via OneDrive. Some employees clicked on the link, but could not open the attachment. So they sent a group email asking if anyone else got this email from the colleague.

I texted the sender asking if his email was legit…and he said “Don’t open that!” Apparently his boss got hacked last week and her email sent out those messages. He clicked on it. Now his email is sending out those same emails.

I’m not sure what to do here—can you assist? Is there a scan that they/we can run? Is it something you can help with remotely?

We don’t yet know that there’s any cause for concern. To start with, have any of you gotten any indication that your own accounts are spamming other people with this bogus message?

Additionally, I have somewhat less concern for anyone who tried to open it on a Mac or via Outlook on the web. How many of you use the Outlook app on Windows?

I don’t tend to act as an alarmist in these situations, not because there isn’t a concern, but because any cause for concern gets triggered by initially opening the attachment. If you don’t see misbehavior, sussing the possible attack or effects can’t be comprehensive. It could be something that hits your computer, or your email, or ransomware that locks your files, and you don’t know ’til you know.

So with all that said:

  1. Any of y’all please be encouraged to change your email and computer passwords. Also, if you haven’t enabled two-factor authentication in your email accounts (or any other online service), run-don’t-walk to do that.
  2. Please ask the team if anyone has noticed their computer misbehaving, especially the browsers. If Safari, Firefox, or Chrome (or Brave or Vivaldi or Opera or…probably not Lynx…) misbehave in any suspicious way, let’s check it out. Most likely symptoms would be pestilent pop-ups, bogus search engines (i.e. does that really look like the real google.com?), persistently changed homepages, or unwanted buttons or extensions.
  3. We can do audits of each of your computers, or you can run manual scans in Windows (see below) or Malwarebytes for Mac: https://www.malwarebytes.com/mac/.
  4. You could each check with your correspondents to see if anyone got similar spam from you.

Please holler as soon as you run into any of that!

Corrupt file on Synology

I hit a file on the Synology the other day that was corrupt. Is there a Disk Utility equivalent to run?

Oy. I’m real sorry you encountered that stressor.

There are just a couple of tools in the Synology* to deal with file degradation after the fact. I know you don’t need me to say that probability of recovery is a black box, but it’s worth a go. Also, I prefer to have a backup of everything on a volume before I repair the file system on it:

First, look in Storage Manager > Overview. If the volume reports as anything but “✅ Healthy,” you can repair it. Look for the same kind of thing in Storage Manager > Storage Pool. More info here.

I’m always hesitant to give a “here’s how to prevent this in the future” after a bad event, but DSM Self Healing is worth considering, primarily because you keep live data, as opposed to just backups, on the box.

Note that you have to enable “Enable data checksum for advanced data integrity” when you first create a shared folder. But it would be easy enough to recreate your shares and move everything into them.

Also in the future-proofing vein, I absolutely recommend any Synology owner subscribe to Backblaze B2 backup. Enabling it on the NAS is a little nerdy, but worth it for peace of mind. Here’s a guide.

* The Synology OS is called Disk Station Manager (DSM)

Download videos from the Internet

How can I download and save videos from the Internet? Specifically from YouTube, rumble, etc.

Short answer: Click the big green “Get 4K Video Downloader ⬇” button on this page: https://www.4kdownload.com/products/videodownloader/4

Free for 30 days, one-time $15 after that.

Alternatives: There are so many of these apps that it took a bit to find one I could trust and that wouldn’t have a bunch of ads and junk. Also, I got led down a couple nerdy paths, the only fruit of which was a little self-education.

And even as I’m typing this, I just thought “oh what about this” which finally led me to a good free GUI: ViDL (https://omz-software.com/vidl/). And I found some trustworthy reviews of it.

Obviously Google doesn’t want us to do this, so the tools are…not clandestine, but let’s say, a bit grass-roots.

And finally, I can’t help pointing to my own usual solution, youtube-dl, which is all done in the Mac’s command-line. Here’s a short explanation by beloved Apple podcaster Casey Liss: https://www.caseyliss.com/2017/8/10/youtube-dl

Clean out Trash or Downloads

Should I clean out my Trash or Downloads folders regularly?

For sure, both Downloads and Trash are good to keep eyes on. The productivity nerds would say that ideally one keeps both folders empty, with the idea being that anything important enough to keep gets stashed somewhere else.

Less compulsive Mac folks might simply say that too many files in a folder can make Finder squirrelly, so keeping it under 500 files and definitely deleting bigger ones quicker should keep you running smoothly.

Got a new Apple TV

We bought the new Apple TV for the conference room. Is there anything special that I need to do besides plugging it in to to make sure that everyone is able to connect to it via AirPlay?

Should be pretty straightforward. Just name it something simpler, logical, and/or fun, and join it to your wifi. From there it should work straightaway.

There are some settings to consider for security, branding, and office environment in Settings > AirPlay and HomeKit, including new ones in the new aTV. You might especially look at Conference Room Display. I don’t think you necessarily want to require a PIN code every time someone wants to connect, unless that has ever been an issue, but you might wanna make sure that it is in fact off.

If you use AirPlay heavily in a business environment, and you have a more versatile router, you can give the Apple TV higher priority on the network to reduce hiccups.

Google cementing OAuth

As G Suite admins will have seen in email…

Starting February 15, 2021, G Suite accounts will only allow access to apps using OAuth. Password-based access will no longer be supported.

And fortunately, this particular thing can get quickly discarded from the pile of stuff you gotta worry about. It’s specifically about any third-party apps that you have given permission to access any of your Google accounts. For example, when we set up Apple Mail, we have to grant access to our Google account, and that goes over this OAuth the above email references. Any modern app should be similar.

Even if there were some app that we’ve connected a while back under the old scheme, we would just update it and reconnect it when we run into it not working. IOW, I ain’t concerned about this for any of my peeps.

Mac crashes during sleep

I may have to take back my iMac Pro! It keeps crashing while asleep. I put it to sleep at night and wake up to find it is off. When I turn it on I get the ol’ “Your computer was restarted because of a problem” error. It works ok when working but I wonder if this isn’t an omen?
This happens almost every time I put it to sleep for a while, even while going to lunch.

I’d bet dollars to doughnuts that’s not your iMac but one of your peripheral devices. Try unplugging everything you can when you put it to sleep, even keyboard and mouse. If you don’t encounter that error, leave keyboard and mouse plugged in next time you put it to sleep. If no error, plug in main backup drive. If no error, add your next most important device. You get the idea. Rinse and repeat. Eventually we all narrow it down to the cheap USB hub we bought 7 years ago… 😉 (In one case for me, it was actually a card reader that I had in the expansion slot of my MBP.)

Mesh Wi-Fi for the Home

Can you recommend a good whole-home mesh wireless system?

The options for home networking have evolved so much in the last couple of years. There are now several powerful systems that are sooooper-easy to set up.

As usual the Wirecutter has already done the hard part for me way better, with both explanation and product recommendations.

The upshot is: the Eero system, recently purchased by Amazon, is the best and easiest, and has been since they brought mesh Wi-Fi to the consumer market a few years ago.

I’ve rarely recommended it to a client who didn’t have it all set up for themselves by the next time I talked to them.

The most likely reason one wouldn’t opt to buy the Eeros is a dislike of Amazon owning the cloud control of one’s internet connection and home network. In which case, while I haven’t gotten hands on the D-Link Covr pack recommended by that article, but they say it’ll cover up to 6,000 sf.

I do know and deeply love their “Also great” pick, the nerdier, not-drop-dead-simple Synology. The Synology is also the only one of these systems I can recommend in a business environment, as it is more configurable and flexible, and offers possibilities for remote access.

The Wirecutter ranks Google Wifi as lesser, but I think it’s well worth considering if one has any toes dipped in the smart-home pool. I had previously disregarded the units not because they’re not great, but because they offer just slightly less performance than their competitors. But they recently released the Google Nest Wifi models, which have better specs. You can get the pack called “Google Nest Wifi Router and Point” — the Point being both a mesh wifi access point and a smart speaker a la Alexa but using the very good Google Assistant — or you can just get two of the Router units, which offers better performance and no microphone.

Separate point because I can’t help myself: I really enjoy the smart-home stuff, and most recently we invited a couple of Apple HomePods into the family. We love them almost as much as the dog. I’ve also tried and really liked the Google Home, Home Hub screen, doorbell, and other Assistant devices. I know the Amazon Echo system is popular and very capable, but all the tech reporting around them gives me privacy concerns that I don’t (currently) have about Apple or Google.

Turn on Find My… iPhone, iPad, or Mac

Here’s the full page about enabling Find My iPhone, Mac, and other devices. In short:

On iOS

  1. Tap Settings > [your name] > Find My
  2. Ensure Find My iPhone says “On”
  3. If you’re asked to

On Mac

  1. Click Apple menu  > System Preferences > iCloud
  2. Turn on Find My Mac

Notes

If you don’t have Location Services turned on on your device, you’ll be instructed on doing that.

In iOS 13, Apple squeezed two apps into one: Find My Friends and Find My [Gadget] are now Find My. Here’s the icon you seek:

Also in iOS 13, Apple enabled Offline Finding, which gives you a chance of pinging it when there’s no Wi-Fi or cell signal. Apple’s full post on lost and stolen Macs.

And, hoping you never need it, here’s how to locate a lost or stolen device.