News in July 2019

Microsoft Windows 10 has been a hot topic around ConsumerAffairs, lately. The operating system has faced rebukes from tech pundits when it was first released, issues with updates, and problems with its Bluetooth connectivity. 

If you’re someone who counts on Windows 10’s “Defender” antivirus software to protect you from malware threats, consider yourself forewarned about yet another issue.

Meet Trickbot

Trickbot -- an old hacking favorite -- has come out of the shadows and is on a serious spree, reportedly tagging 250 million email accounts to spread its curse.

The angle that Trickbot works is worming its way past Windows Defender by posing as a credible source, then snatching online banking credentials. It’s also been known to steal from cryptocurrency (e.g. Bitcoin) wallets, browsers, and other systems holding credentials.

Once it’s past Defender’s gatekeepers, Trickbot turns right around and disables Defender, weakening a user’s computer even further. 

Is there a fix?

When ConsumerAffairs searched Microsoft’s support site for information regarding Trickbot, we didn’t find anything in particular, but the company did offer basic tips that users can use to possibly protect their computers. Note that we said “possibly.”

What we did find in our research is that jumping in the ring with Trickbot is not for the casual computer user. BleepingComputer reports that the new version of the malware has added 12 new processes that it disables. Adam Kujawa, the Director of Malwarebytes Labs at internet security company MalwareBytes, told ConsumerAffairs that those new tricks make it incredibly powerful when it comes to lateral movement through networks.

“We’ve mainly seen Trickbot being pushed toward organizational networks, like businesses, and usually as a secondary payload after another infection (like Emotet, another banking trojan),” Kujawa said.

“However, Trickbot has had a lot of success in the past distributing itself. Newer versions of Trickbot also have the ability to spread via infected emails from infected systems, making it even more likely to spread when users encounter the email without protection or awareness of what it is.”

Businesses are particularly vulnerable

From Kujawa’s vantage point, Trickbot is inclined to wreak more havoc with businesses than consumers. 

“While it’s totally possible that a consumer could encounter Trickbot, they aren’t the intended target, and the kind of damage that could be done to an enterprise network is far greater than that done to a single consumer endpoint,” he said.

Nonetheless, Kujawa says Trickbot’s popularity is putting it in the crosshairs of most antivirus developers, who are trying to work their magic to figure out how to prevent and stop it.

“So while this version of Trickbot might go after Windows Defender, there are other security tools out there to protect users,” Kujawa offered.

“By utilizing some of the more popular vendors out there that employ real time protection (to stop the threat before it does damage), a user can stay safe from a Trickbot infection. However, if the user is infected before cleaning the system, the following is a list of what the user should do after they have removed Trickbot from their system:

1. You might want to have a credit freeze or monitor put in, for all the breaches and attacks of the last few years, you should probably do this anyway.

2. Change your passwords on any accounts you might have accessed while you were infected. If you don’t know, then change them all!

3. If you think you might have provided your financial information (CC info, bank account #, etc.) to a website or logged into your bank, you should probably have new cards issued and inform your bank that you were infected and that you don’t know if they will try to use your bank info for fraud.

4. Reach out to anyone who might be on a contact list or e-mail list that you have locally saved or accessed while infected with Trickbot, then send an e-mail out to those folks letting them know that if they have seen any odd e-mail from you, it was from this malware and to ignore it.”

Not as serious as it sounds?

While the number of affected users is very high, Kujawa points out that consumers who are properly prepared should have no issue combating Trickbot.

“Overall, this isn’t a difficult threat to defend against if you are ready for it,” Kujawa told ConsumerAffairs. “The most damage that has been caused by Trickbot, recently, usually has to do with an organizational network, a higher return on investment and for those organizations who were unprepared for an attack like that.”

But if the mere thought of being hacked sends you running for the hills, Kujawa says the extra-cautious computer user could up their ante by adding anti-exploit technology, which could spot a malicious script and stop it in its tracks before it downloads and installs the Trickbot payload.

Sears retirees who had life insurance coverage through the company may now receive just $135 each from the now-bankrupt retailer, Bloomberg reports. 

About 29,000 former Sears employees had a life insurance plan through the company, which sold its stores and most of its assets to chairman Eddie Lampert’s hedge fund, ESL Investments, back in January. 

In March, Sears canceled its workers’ life insurance plan and gave them the option to pay for their own life insurance. The terminated plan would have provided death benefits of between $5,000 and $14,500 for workers, but the company now says it doesn’t have enough money to pay the full amount. 

Sears has laid out a new plan that would drastically reduce the amount of money its retirees will receive. Former Sears employees who were slated to receive thousands in benefits could now receive just $115 to $135, according to a court filing.

“The new plan is totally unacceptable to the retirees,” Ronald Olbrysh, chairman of the National Association of Retired Sears Employees, told Bloomberg. “It’s totally unfair, what Sears is attempting to do.”

A hearing on the proposal is set for August 12.

During an interview with CNBC, Health and Human Services Secretary Alex Azar said that President Trump is currently drafting a proposal that would allow the U.S. to import lower-cost prescription drugs from Canada. 

Trump, who is seeking reelection in 2020, is “working on a plan on how we can import drugs safely and effectively from Canada so the American people get the benefit of the deals that pharma themselves are striking with other countries,” Azar said on CNBC’s “Squawk Box.” 

The proposal is being designed with the aim of lowering the prices of drugs in the U.S. by bringing in drugs from Canada, which are cheaper. Under the plan, oversight from the Food and Drug Administration would help ensure the safety of the imported drugs.

"We all know how unfair it is that other countries are paying lower prices for the same drugs, and we're taking action," Azar said on a Wednesday call with reporters.

Lowering drug costs

Critics of the plan include drug-makers, who argue that importing drugs would put consumer safety at risk. 

“There is no way to guarantee the safety of drugs that come into the country from outside the United States’ gold-standard supply chain,” PhRMA President and CEO Stephen J. Ubl said in a statement.

Meanwhile, several Democratic presidential candidates, including Sen. Amy Klobuchar and Sen. Bernie Sanders, have signaled their support of importing FDA-approved drugs from other countries. Sanders says doing so would increase competition and lower prices.

The Trump administration’s proposal is far from being put into action, as it will need to make its way through a lengthy process for obtaining regulatory approval after its details are hammered out. 

Boeing 737 MAX jets have yet to be reintroduced to airlines’ daily flight schedules, but the Federal Aviation Administration (FAA) is hoping civil aviation regulators across the globe approve Boeing’s fixes for the aircraft at about the same time. 

In a letter to Congress seen by Reuters, the FAA’s acting administrator said the agency “hopes to achieve near simultaneous approval from the major civil aviation authorities around the world” 

The planes were grounded worldwide in mid-March in the wake of two fatal crashes that occurred just five months apart. The crashes were determined to be caused by a software error. 

Planes still grounded

Boeing CEO Dennis Muilenburg said recently that he was optimistic that the MAX would be cleared to return to the skies as early as October following a certification flight in “the September time frame.” Some have estimated that the planes may not resume service until next year.

Acting FAA Administrator Dan Elwell told Congress that the agency “will lift the 737 MAX grounding order only when it is safe to do so.”

The agency’s words to Congress come a few weeks after FAA officials found another potential problem in the 737 MAX’s computer system. During simulator sessions, the flaw raised alarm for its potential to cause the aircraft to dive in instances where it should be climbing. 

“I’m sure this will cause us to have to take the MAX out of the schedule beyond Oct. 1,” Southwest CEO Gary Kelly told employees in early July, according to Reuters. Kelly added that the company would also see “what other modifications we might need to make our plans for this year because it’s obviously extending well beyond what I had hoped.”

A new study conducted by researchers from Rutgers University found that when young children have respiratory infections, doctors more commonly choose allergy medications over cold or cough medicines. 

“Families often treat their children’s respiratory infections with cough and cold medicines, some of which include opioid ingredients, such as codeine or hydrocodone,” said researcher Daniel Horton. 

“However, there is little proof that these medications effectively ease the symptoms in young children. Also, many cough and cold medicines have multiple ingredients, which increases the chance of serious accidental overdose when combined with another product.” 

Making the safest choices

The researchers utilized responses to national surveys to get a better understanding of doctors’ trends in treating respiratory infections in children under the age of 12. Starting from 2002 and ending in 2015, the researchers were able to evaluate data from over three billion respiratory incidents that occurred via emergency room trips or ambulatory clinics. 

Though the results revealed that doctors prescribed nearly 96 million cough or cold medications over the course of the 13-year period, prescriptions for these drugs were on the decline starting in 2008 due to a Food and Drug Administration (FDA) warning. 

The agency advised parents that cough and cold medications could come with serious side effects, as Horton explained. Regulators said the drugs should be used sparingly or not at all for children under the age of six.

After the FDA made the warning public, doctors started prescribing cough and cold medications less, and they started prescribing antihistamines more. Prescriptions for cough and cold medications containing opioids went down nearly 70 percent after 2008, while prescriptions for the drugs without opioids went down nearly 60 percent. 

Though antihistamine prescriptions have increased in the last decade, the researchers remain unsure about whether they are a better alternative when young children are suffering with a cold or the flu. The team recommends that parents look for natural remedies when possible. 

“Sedating antihistamines such as diphenhydramine [Benadryl] may have a small effect on some cold symptoms in adults,” said Horton. “However, there is little evidence that antihistamines actually help children with colds feel better or recover faster. We do know that these medicines can make some kids sleepy and some kids quite hyper.” 

Natural remedies

One recent study also warned parents against giving their kids, especially those under six, decongestants when they suffer from a cold or the flu. 

The researchers explained that there are several potential side effects, including upset stomach, drowsiness, or headaches. The team said that parents should instead rely on more natural remedies, like eucalyptus oil, humified steam, or probiotics. 

Similarly, experts have emphasized how effective vitamin C can be in shortening the duration of colds, especially when taken in higher doses. 

"Given the consistent effect of Vitamin C on the duration of colds, and its safety and low cost, it would be worthwhile for individual common cold patients to test whether therapeutic 8 g/day vitamin C is beneficial for them,” said researcher Dr. Harri Hemilä. “Self-dosing of vitamin C must be started as soon as possible after the onset of common cold symptoms to be most effective.”

The U.S. Labor Department has adopted a new rule to make it easier for people working for small businesses to save for retirement.

There’s a current retirement crisis, with several surveys showing workers are not saving for their non-working years. In some cases, it’s because their living expenses take all their income. In other cases, it’s because their small business employers can’t afford to set up a retirement savings program.

The new rule is designed to make it easier for small businesses to offer retirement savings plans to their workers through Association Retirement Plans (ARPs). That concept allows small businesses to work together to offer retirement plans to their employees.

"Less than a year ago, President Donald J. Trump signed an Executive Order focused on expanding quality, affordable workplace retirement plan options for America's small businesses and their employees," said Acting Secretary of Labor Patrick Pizzella. "Many small businesses would like to offer retirement benefits to their employees, but are discouraged by the cost and complexity of running their own plans. Association Retirement Plans offer valuable retirement security to small businesses' employees through their retirement years."

Under the rule, ARPs could be formed by multiple employers in a city, county, state, or a multi-state metropolitan area, or in a particular industry nationwide. The plans could also be offered through Professional Employer Organizations (PEO). 

A PEO is a human-resource company that takes over many of the employment responsibilities employers might have for their employees.

Comparable to large company packages

Under the new rule, small businesses will be able to offer benefit packages comparable to those offered by large employers. The Labor Department has set up the plans to reduce administrative costs through economies of scale. 

Because many employers will be working together, they should have a stronger hand in negotiating with financial institutions and other service providers. The new rule goes into effect September 30, 2019.

The Labor Department has reported that nearly 38 million employees of small and midsize companies lack a workplace retirement plan. Government statistics show that in 2018, 53 percent of workers at companies with fewer than 100 workers had access to a retirement plan while 85 percent of workers at larger companies could enroll in a retirement plan.

In January, a Merrill Lynch report found that most U.S. workers under-save for retirement by about 20 percent. On average, the report found that retirement comes with a price tag of over $700,000 -- about 2.5 times that of the average house.

Britax Child Safety of Fort Mill, S.C., is recalling about 200 modified thru-bolt axles for use with BOB Jogging Strollers distributed through the BOB Information Campaign from January 10 – April 26, 2019.

The modified thru-bolt on the front wheel can fracture, allowing the wheel to detach from the stroller, posing fall and injury hazards to children in the stroller and adults operating the stroller.

The firm has received 8 reports of the modified thru-bolt fracturing. There are no reports of injuries.

This recall involves the modified thru-bolt axle provided by Britax free of charge as one of the available incentives to eligible consumers in connection with the BOB Information Campaign announced on January 10, 2019.

The model number of the modified thru-bolt axle is S11393700 and it was manufactured for use with BOB Jogging Strollers made between 1/1/2009 to 9/30/2015.

The modified thru-bolt axles, manufactured in China, were distributed by Britax free of charge to consumers in connection with the BOB Information Campaign announced on January 10, 2019.

What to do

Consumers should immediately stop using the modified thru-bolt axle installed on the front wheel of their BOB jogging stroller.

Britax is contacting consumers directly who received the modified thru-bolt axles and providing them with a free replacement thru-bolt axle.

Consumers may also contact Britax for a free replacement thru-bolt axle.

Consumers who have participated in the BOB Information Campaign, and have already been contacted by Britax, will automatically receive a replacement thru-bolt.

Consumers may contact Britax toll-free at (888) 427-4829 from 9 a.m. and 5:15 p.m. (ET) Monday through Thursday, or between 9 a.m. and 4:45 p.m. (ET) on Friday or by email at US-customerservice@britax.com.

Kent Quality Foods of Grand Rapids, Mich., is recalling approximately 48,681 pounds of ready-to-eat polish sausage with beef .

The product may be contaminated with extraneous materials -- specifically pieces of flexible pink rubber.

There are no confirmed reports of adverse reactions.

The following ready-to-eat item,  packaged on June 17, 2019, and June 20, 2019, is being recalled:

• 36-oz. packages containing three 12 oz. individually wrapped pieces of “TETON WATERS RANCH COOKED UNCURED POLISH SAUSAGE MADE WITH BEEF” with a Use/Freeze By SEP 16 2019 or Use/Freeze By SEP 19 2019.

The recalled product, bearing establishment number “EST. 5694” on the package, was shipped to retail locations in California and Utah.

What to do

Customers who purchased the recalled product should not consume it, but discard or return it to the place of purchase.

Consumers with questions may contact Jim Zubkus at (616) 459-4595.

Just days after Equifax and the government settled the largest data breach in history, Capital One disclosed what may be the second-largest.

The Virginia-based bank reports that a hacker accessed the records of around 100 million consumers in the U.S. and Canada. In 2017, hackers penetrated Equifax’s network and stole personal data on 147 million Americans.

According to the bank, the breach may have occurred in March of this year. On July 17, an external security researcher reported a configuration vulnerability that the company confirmed two days later. It further says the accused hacker has been arrested and that it is “unlikely that the information was used for fraud or disseminated” by this individual.

"While I am grateful that the perpetrator has been caught, I am deeply sorry for what has happened," said Richard Fairbank, Capital One’s chairman and CEO. "I sincerely apologize for the understandable worry this incident must be causing those affected and I am committed to making it right."

Capital One said it believes the breach, which was discovered July 19, affected approximately 100 million people in the United States and around 6 million in Canada. The company said its investigation to date shows no credit card account numbers or log-in credentials were compromised, and neither were over 99 percent of Social Security numbers.

Compromised data

Most of the accessed information concerned consumers and small businesses that applied for a Capital One credit card from 2005 to the present. The information includes names, addresses, zip codes/postal codes, phone numbers, email addresses, dates of birth, and self-reported income. 

The intruder was also able to access 140,000 Social Security numbers and 80,000 linked bank account numbers of secured credit card customers. Nearly 1 million Canadian Social Insurance numbers were compromised in the incident.

Capital One said it will notify affected consumers using a variety of channels. It will also provide  free credit monitoring and identity protection available to everyone affected.

Last week, Equifax agreed to pay $425 million to settle Consumer Financial Protection Bureau (CFPB) charges stemming from its 2017 data breach.  In all, the company could pay up to $700 million in total relief due to other penalties.

President Trump has signed a bill providing money for health benefits for first responders who developed diseases after working at the scene of the September 11, 2001 terrorist attacks.

There are sufficient funds to provide benefits through 2092 and future applicants have another 71 years in which to file a claim.

“Today we come together as one nation to support our September 11 heroes, to care for their families and to renew our eternal vow: Never, ever forget,” Trump said at the bill signing ceremony.

The signing was the culmination of effort by first responders and their supporters, including comedian Jon Stewart. When the measure appeared to be stalled in mid June Stewart appeared at a congressional hearing and delivered a tongue-lashing of lawmakers reminiscent of a scene from the 1939 Frank Capra film “Mr. Smith Goes to Washington.”

95,000 claims

So far, the Congressional Budget Office (CBO) estimates about 95,000 people - mostly first responders -- have made claims against the fund. Going forward the CBO estimates the fund could receive another $10 billion in claims over the next 10 years.

Senate Majority Leader Mitch McConnell (R-Ky.) said the fund was never in danger of expiring but it appeared to come close, prompting Stewart’s impassioned plea. The deadline for making a health claim was set to expire in December and officials administering the fund warned it might not have money to pay all the claims made by then. 

Three weeks after Stewart’s appearance before a House subcommittee, the House passed the extension. The Senate gave final approval last week.

Private efforts

Eighteen years after the attack on the World Trade Center and Pentagon, private efforts also continue to support the men and women who responded on that day. RingBoost, a company selling custom phone numbers, announced that it will be donating 5 percent of proceeds over the next month to The Stephen Siller Tunnel to Towers Foundation. 

The organization honors Stephen Siller, a New York City firefighter killed on 9/11. The money is used to support families financially.

Earlier this month, Amazon entrepreneur Lori Barzvi, owner of ForGuy, LLC, announced her business would donate a portion of its profits to 911 Health Watch, an organization that provides services for first responders and victims and lobbies to ensure that the government is providing all necessary benefits.

Following news that Equifax will begin providing monetary relief to those affected by its massive breach, the Federal Trade Commission (FTC) is warning consumers not to be duped by phony Equifax settlement claims websites. 

"Wouldn’t you know it? People may have already started putting up fake websites meant to look like the official Equifax settlement claims website,” the FTC's acting assistant director Michael Atleson said in a blog post. 

Consumers are advised to “beware of fake websites claiming to be the Equifax settlement claims website” and instead apply for claims through the link provided on the FTC’s official website. The website also has information about the $125 payout Equifax has promised consumers who were affected by the data breach. 

"A couple more things to remember," Atleson said. "You’ll never have to pay to file a claim for these benefits. And anyone who calls and tries to get you to file a claim is almost certainly a scammer."

Consumers can find out if they’re eligible for a payout from Equifax by visiting www.equifaxbreachsettlement.com or calling the settlement administrator at 1-833-759-2982.

Over the last year or so, new car sales have continued to slowly decline. July sales are expected to be around 16.7 million units, about the same or slightly less than numbers for July 2018.

But consumers continue to spend more for a new ride. Thomas King, senior vice president of the Data and Analytics Division at J.D. Power, says the average carbuyer is expected to spend $33,000 -- about $1,400 more than last July.

It’s not that dealers are raising prices so much as consumers are choosing to purchase more expensive vehicles, and vehicles with more expensive options. Primarily it’s the choice of an SUV that is driving the average price higher.

According to J.D. Power, the percentage of new vehicle sales through mid-July for SUVs has risen to an all-time high level, accounting for nearly 52 percent of new car sales. Automakers have recently introduced several new midsize SUV models that are attracting consumers’ attention.

Sedans go begging

While consumers are purchasing more SUVs, they continue to shun sedans, which typically cost less. Sedans now account for a little more than a quarter of all monthly new vehicle sales.

Broken down by category, consumers spend an average of $26,853 on a car but $35,487 on a truck or SUV.

Recent spending has been fueled by generous dealer incentives and lower interest rates, both of which make monthly payments more affordable. The average interest rate for a new vehicle loan so far in July is 5.7 percent, down more than 50 basis points from earlier in the year. That average should drop even lower if the Federal Reserve -- as expected -- cuts a key interest rate this week.

Financing incentives

Financing incentives have been especially strong this month. According to J.D. Power, auto sales with an interest rate of less than 1 percent have made up 9.2 percent of all new vehicle loans.

"Despite the continued slow-down in sales, consumers are expected to spend more than $2 billion more on new vehicles than last year," King said. "This is a clear reflection that manufacturers are building the types of vehicles that shoppers want. Consumer expenditures in July of $39 billion represents the highest level for the month since 2017."

Sales are likely to pick up in August, traditionally a strong month for new cars. In the past, August and September have been the months with automakers introduce next year’s models -- something that now takes place nearly all year round.

A new study conducted by researchers from Portland State University found that bosses who have a tendency towards bullying can not only impact employees’ performance on the job, but can also negatively impact safety in the workplace. 

“Organizations need to understand how important it is to curb leaders’ bad behavior and to create positive team dynamics, so that there will be fewer negative safety consequences for employees or customers,” said researcher Liu-Qin Yang. “It’s really critical to manage such leader behavior, support victimized employees, and prevent such issues.” 

Boosting the employee experience

While bosses’ leadership style can affect employees’ work performance in any field, this study focused on positions where safety is of the utmost importance, such as manufacturing techs and airline pilots. 

Those involved in the study were asked to report on their experiences with bosses in less than ideal circumstances, such as situations where aggressive leadership styles had affected various aspects of the job. 

The results revealed that aggressive and combative bosses made employees more likely to make decisions that were better for them individually, rather than for the group as a whole. When it comes to jobs where safety is of the utmost importance, the researchers say this dynamic could create hazardous conditions.

“When people are less sure about their strengths and weaknesses and their status within a group, they become more sensitive,” said Yang. “They’re more likely to respond negatively to their bosses’ bullying behaviors.” 

The study did recommend several ways for supervisors to implement safety policies, mainly in ways that prioritize employee bonding, a culture that places an emphasis on people, proper leadership, and workplace evaluations so that no one feels left out. 

Healthy relationships in the workplace are key

Ensuring that employees are happy at work is crucial to overall productivity in the workplace, and bosses who choose to form healthy relationships with their employees are more likely to get the most productive hours out of them. 

This idea was made clear in a recent study that found bosses who are profit-driven can yield employees who aren’t performing at their very best.

“Supervisors undoubtedly face heavy scrutiny for the performance levels of their employees, and as such they may tend to emphasize the need for employees to pursue bottom-line outcomes at the exclusion of other competing priorities, such as ethical practices, personal development, or building social connections in the workplace,” the researchers wrote. “However, in doing so they may have to suffer the consequence of reduced employee respect, loyalty, and even liking.” 

Waymo, a branch of Google’s Alphabet which is currently developing self-driving cars and taxis, has announced that it’s been working with DeepMind on a new technique for training its autonomous vehicles. 

Waymo and AI specialist DeepMind, which is also an Alphabet company, created a “Population Based Training” (PBT) method to train Waymo’s self-driving cars in a more efficient way. 

The PBT method “enabled dramatic improvements in how well -- and how quickly -- vehicles were able to sense pedestrians, bicyclists, and motorcycles,” Waymo stated. The approach decreased false positives by 24 percent compared to the AI algorithm that involves having researchers and engineers handpick AI models that need improvement through trial and error. 

Evolution-based training method 

The method has neural networks (which Waymo’s self-driving cars use to execute many driving tasks) “compete with each for ‘survival’ in an evolutionary fashion,” explained Yu-hsin Chen, Waymo’s lead software engineer in a blog post.

“If a member of the population is underperforming, it’s replaced with the ‘progeny’ of a better performing member,” Chen said. “PBT doesn’t require us to restart training from scratch, because each progeny inherits the full state of its parent network, and hyperparameters are updated actively throughout training, not at the end of training.” 

“Compared to random search, PBT spends more of its resources training with good hyperparameter values,” Chen said. 

In an interview with the Financial Times, Chen said his team saw improvement in tasks like "detecting pedestrians, cyclists and motorcyclists, highway lanes, vegetation, the road, and it also improved our data labelling process."