Stein Solutions

Stein Solutions Security, networks, performance tuneups, digital forensics, advanced troubleshooting, data recovery, and education. This is a ministry of service for me.

Also the top Thumbtack computer pro in the nation with almost 800 5-star reviews! Security, networks, performance tune-ups, data recovery, and education. Also the top Thumbtack computer repair pro in the nation (see 750+ reviews at http://www.thumbtack.com/tx/mckinney/software-developers/dba-stein-solutions )

We specialize in security (virus removal), networks, performance tune-ups, data

recovery, data backups, troubleshooting complex issues in Windows and educating clients in best practices. Our prices and quality are unmatched in the market. Some of our services include:

[] Guaranteed removal of any virus/malware/spyware – even when your antivirus can’t remove them. While we take care of removing your virus, our deep and thorough inspection process last several hours using advanced tools and manual digital forensics investigation – taking as many hours and days as necessary and working around your schedule. We iterate to (a) gather information for offline analysis, (b) analyze the data, (c) bring the PC to better health, and (d) plan/implement next steps and repeat these steps. This is designed to spend the necessary time to fix your PC properly, to advise you, and make your PC faster and safer — as fast or faster than the day you purchased it and safe enough to protect you from the weakest link in the security chain: human susceptibility to socially engineered deception by the evil software you may have downloaded and unethical hackers who modified your PC. I hope to educate one person at a time and they in turn can educate others.
[] Providing you a detailed and professional report of what happened, why it wasn’t detected and how to prevent it from happening again.
[] Follow-up every few weeks (remotely) with a 30-minute “health check” glance to make sure the machine remains healthy. A long-term support plan is available at whatever you can afford and never an unreasonable amount.
[] Optimizing and assuring you are not misconfigured in your software and hardware firewalls, routers, and switches. Rest easy. If applicable, I will show you how you are misconfigured and under attack,
[] Doing deep inspection of your Windows event logs looking for errors and warnings that are portents of imminent hardware and software failures, corruption, and unreliable data.
[] Treating your data confidentially, making sure it has integrity (from corruption, unintended mishaps and abuses), and is available for your personal or business needs in a reliable manner.
[] Optimize your graphics display and power management for best performance that matches your PC and how you use it.
[] Check for hardware and file-system disk errors, overheating motherboard and disk drives from poorly built custom computers or poorly designed mainstream ones, and system bottlenecks from poorly design programs (businesses: I also do software code reviews and show you where your application design is flawed, if applicable) — and if desired, I can remedy or recommend how to remove those bottlenecks has taken place.
[] each you to be pro-active, not reactive. We also can help you with the following:

Transferring data to a new or different PC
Setting up your new computer
Backing up important data
Finding lost or deleted data
Getting Email Up & Running
Learning More About Your PC and/or server

And so much more! This is all from 50 years of combined engineering experience (35 for Harry, 15 for Andrew) as highly-qualified software engineers, I/T network and security administrators. Remember what (Clint Eastwood said multiple times in ‘Dirty Harry’ movies): “A good man has got to know his limitations!”

We offer worldwide remote support and local support within a 35 mile radius of McKinney, TX.

So here is the seminal talk given by AI LLM expert Nicholas Carlini -- this is precisely what the cockroaches in the res...
04/24/2026

So here is the seminal talk given by AI LLM expert Nicholas Carlini -- this is precisely what the cockroaches in the rest of the world (and here in the USA) will be doing - using AI to find vulnerabilities in source code not spotted before. Easy Peasy to do. Talk given approx 4 weeks ago or approx late March 2026. Stunning for those of us with software development and security backgrounds.

Nicholas Carlini, Research Scientist, Anthropic, speaks at [un]prompted 2026 on: Black-hat LLMs.Large language models are now capable of automating attacks t...

This article is not surprising.Router software has always been buggy. A lot of it is built on open-source components, bu...
04/24/2026

This article is not surprising.

Router software has always been buggy. A lot of it is built on open-source components, but to be clear, I am not blaming open source itself. Open source can often be audited, improved, and patched faster than closed-source software. The bigger problem is the way router manufacturers package it, customize it, ship it, and then often fail to keep it patched for very long.

Meanwhile, every consumer router manufacturer keeps cranking out varying models, revisions, and firmware branches. Many of these devices are firmware-out-of-date right out of the shipped box. Then they sit in homes and small offices for years, quietly exposed to the internet, with default settings, weak admin habits, old firmware, and no real monitoring.

Very few consumers update their router firmware. Frankly, I suspect many small businesses and even some corporate environments are not much better. Most people do not keep up with CISA-published vulnerabilities, vendor advisories, end-of-life notices, botnet campaigns, exposed services, or firmware release notes. It is beyond challenging. It is practically impossible for the average home user.

And this is the part people often miss: a modern consumer router is not just a little plastic box with blinking lights. It is basically a small Linux computer sitting between your home and the entire internet. It has services, ports, credentials, certificates, firmware, memory, logs, and vulnerabilities - just like a Linux server, Windows server, or workstation.

So now a consumer router, like any Linux/Windows server or workstation, must be locked down. But the average consumer cannot reasonably be expected to harden it properly. That means we are forced to trust the manufacturer to do the job.

Don't hold your breath on a consumer/home router.

Yes, enterprise routers and firewalls are a huge step up. They usually have better support, better update cycles, better logging, better segmentation options, better management, and better security architecture. But they are pricey, and even enterprise gear is not magically safe. Cisco, Fortinet, Palo Alto, Juniper, and others all have serious vulnerabilities from time to time. The difference is that enterprise environments usually have a better chance of detecting, patching, monitoring, and responding.

But even enterprise equipment is going to be challenged by AI tools.

AI will help defenders. No question. It can help analyze logs, detect patterns, compare configurations, explain vulnerabilities, and accelerate patch research. But AI will also help attackers. It can help them read advisories faster, find weak patterns in firmware, generate exploit ideas, automate reconnaissance, refine phishing, and scale attacks against huge numbers of exposed devices.

That is the part that should make everyone pause.

We are moving into a world where the number of vulnerable devices is enormous, the number of under-maintained routers is enormous, and the tools for finding and exploiting weaknesses are getting faster and smarter.

Rebooting a router may help temporarily in some cases. Updating firmware helps more. Disabling unnecessary services helps. Replacing end-of-life hardware helps. Using strong passwords helps. But the larger issue is that the entire consumer-router ecosystem has been treated too casually for too long.

This reminds me Biblically of the chaos created by the Tower of Babel and the kind of global confusion and control predicted in Revelation. Technology keeps promising connection, efficiency, intelligence, and convenience, but it also keeps creating new layers of dependency, fragility, surveillance, and centralized control.

It will get worse before it gets better.

And sadly, I believe this kind of escalating cyber chaos, combined with AI, surveillance, financial control, and global insecurity, will help open the door to a "New World Order" which ultimately ushers in the Antichrist.

All IMHO.

[https://www.forbes.com/sites/zakdoffman/2026/04/09/nsa-warning-reboot-your-internet-router-now/](https://www.forbes.com/sites/zakdoffman/2026/04/09/nsa-warning-reboot-your-internet-router-now/)

"Don't be a victim!" America's spy agency warns citizens — you must act now.

Brian Krebs is a hero to me. I pray for him vigilantly as he is probably the most heroic cyberwarrior out there, with a...
03/03/2026

Brian Krebs is a hero to me. I pray for him vigilantly as he is probably the most heroic cyberwarrior out there, with a lot of friends in the government keeping an eye out for him. His book "Spam Nation" published years ago about his visiting and interviewing criminals in Russia responsible for most of the spam in the world is iconic (to me). And his disrupting the credit card skimmer operations in European ATMs by Mexican criminals, thereby putting his life at risk, is legendary. That's just a smidgen of his accomplishments -- he deserves a Medal of Honor for what he has done. But this story this morning, given what we have learned recently about young teenagers bent on creating cyber-havoc can be added to that list. Digest nice and slowly.

February 28, 2026 23 Comments In early January 2026, KrebsOnSecurity revealed how a security researcher disclosed a vulnerability that was used to build Kimwolf, the world’s largest and most disruptive botnet. Since then, the person in control of Kimwolf — who goes by the handle “Dort” — h...

Google Threat Intelligence Group (GTIG) says the U.S. and broader “defense industrial base” (defense contractors, aerosp...
02/18/2026

Google Threat Intelligence Group (GTIG) says the U.S. and broader “defense industrial base” (defense contractors, aerospace, manufacturers, suppliers) is under a constant, multi-vector wave of intrusions from state actors and criminal groups. China-linked groups are described as the most active “by volume” against defense-sector entities, and are often focused on gaining durable access (including via exploitation of edge devices like VPNs/routers/firewalls, per reporting on the GTIG findings). I provide a link to a summary that report below.

Russia-linked activity is tied heavily to the Russia–Ukraine war context, including targeting organizations involved with drones/UAS and related battlefield technologies, and more “battlefield-adjacent” operations. A major theme is “human-layer” targeting: employees, personal email/accounts, and the hiring/recruiting pipeline (spoofed recruiting portals, fake job offers, and other social-engineering approaches) because it can evade normal corporate security visibility.

The report and coverage also highlight spillover to smaller manufacturers and supply-chain-adjacent firms (extortion, hack-and-leak, disruption), not just prime defense contractors.

Some coverage of the same GTIG material notes instances where attackers used Google’s Gemini (and generative AI more broadly) for parts of attack workflows (research, social engineering, vulnerability analysis/planning), though the core warning is about the breadth of targeting and tactics, not “AI magic.”

How widespread? Overwhelmingly so. Hacker News gives a long list of examples:

https://thehackernews.com/2026/02/google-links-china-iran-russia-north.html

You can also go here

https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use

Let me say this: this should be overwhelming to the layperson as well as to subject matter experts who understand security.

Our report on adversarial misuse of AI highlights model extraction, augmented attacks, and new AI-enabled malware.

A victory against ransomware by the FBI.
01/29/2026

A victory against ransomware by the FBI.

The FBI has seized the notorious RAMP cybercrime forum, a platform used to advertise a wide range of malware and hacking services, and one of the few remaining forums that openly allowed the promotion of ransomware operations.

This is the second of two articles I posted today on facebook SteinSolutions. It is a reminder of the ongoing threat of...
01/12/2026

This is the second of two articles I posted today on facebook SteinSolutions. It is a reminder of the ongoing threat of China, Russia, North Korea, Iran, and others in the cyberwars reality we have lived in for at least 20 years. These countries are relentless. Let me define the word relentless just to be ultra clear: persistent, determined, and unwavering in their pursuit of a specific goal or agenda. Wars are now being fought with AI drones, misinformation campaigns, security breaches, malware, In my reply to this post I will link you to a speech given by the new head of M16 ()the British equivalent of our CIA).

The article describes a browser (Edge, Chrome, Firefox) hacking campaign researchers call "DarkSpectre", which is believed to be linked to China. For more than seven years, the group used malicious browser extensions (small add-ons you install in Chrome, Edge, or Firefox to add features and which I preach to avoid like the plague without “extreme vetting”) to spread malware (harmful software that can spy or steal). The report links three campaigns to the same actor: ShadyPanda (about 5.6 million users), "Zoom Stealer" (about 2.2 million), and GhostPoster (about 1.05 million), totaling more than 8.8 million users.

What made it hard to catch was patience and disguise. Some extensions looked normal for five years or more and only later turned bad. I call that “lurking” and it’s also known as a "time-bomb" in security parlance – and I am happy to explain this to you privately. Example: waiting three days after installation of an extension before contacting a command-and-control server (a computer criminals use to send instructions) to download the real harmful code.

The malware also ran only on roughly 10% of page loads and hid code inside image files (a technique known as steganography), so it blended in. The group could even change what the extension did by changing what their servers sent back, without publishing a new update.

Take a minute to review your installed extensions and remove anything you do not truly need or recognize. Keep your browser updated and be cautious with "new tab" or "dashboard" add-ons that ask for lots of access. Or contact me for training on how to avoid rogue extensions.

DarkSpectre infected 8.8M Chrome, Edge, and Firefox users via coordinated malware campaigns over seven years.

Three cybersecurity employees who turned rogue and became part of a ransomware operation "targeting healthcare and colle...
01/12/2026

Three cybersecurity employees who turned rogue and became part of a ransomware operation "targeting healthcare and collected at least $300 million in ransom payments from more than 1,000 victims until September 2023". In the end, thankfully, they got caught.

Two former employees of cybersecurity incident response companies Sygnia and DigitalMint have pleaded guilty to targeting U.S. companies in BlackCat (ALPHV) ransomware attacks in 2023.

The report describes Kimwolf, a very large “botnet” (a group of infected devices controlled remotely by criminals) that ...
12/29/2025

The report describes Kimwolf, a very large “botnet” (a group of infected devices controlled remotely by criminals) that mainly targets Android-based smart TVs, TV boxes, and tablets. Researchers say the network is already enormous: they conservatively estimate more than 1.8 million infected devices, and after temporarily taking over one control server (called “C2,” short for command-and-control), they saw 3.66 million cumulative infected IP addresses with a peak day of 1,829,977 active devices. The botnet can launch DDoS attacks (flooding a website or service with traffic to knock it offline), but it can also run other functions like proxying (using your device as a traffic relay), remote command access, and file management. XLab Blog
Kimwolf is hard to track because it encrypts its traffic and uses techniques meant to avoid detection, including DNS over TLS (a way to hide DNS lookups inside encrypted connections) and rapid infrastructure changes; the report notes its domains were taken down multiple times, pushing the operators to use ENS (Ethereum Name Service) to make control servers harder to remove. The researchers also found strong links to the Aisuru botnet and believe Kimwolf’s attack power could be near 30 Tbps, which is enough to seriously disrupt major online services. XLab Blog

Practical takeaway: [1] Avoid cheap, unknown-brand Android TV boxes and don’t install “extra” APK apps from random websites. [2] If you own a smart TV/TV box, keep firmware updated, use strong passwords, and consider unplugging or replacing devices that no longer get security updates. I personally attach a small Windows 11 laptop with an HDMI cable to the dumbed-down TV and feel like I have more security and a better understanding of what is going on. Total cost: $150 (a 14” Intel i5-10th gen laptop 256GB SSD, 16GB Ram, Windows 11 Pro. The laptop becomes a Windows desktop I understand and can manage. What’s in your wallet?

Kudos to Pierluigi Paganini for his SECURITY AFFAIRS MALWARE NEWSLETTER for pointing me to this interesting article. URL is URL is

Background On October 24, 2025, a trusted partner in the security community provided us with a brand-new botnet sample. The most distinctive feature of this sample was its C2 domain, 14emeliaterracewestroxburyma02132[.]su, which at the time ranked 2nd in the Cloudflare Domain Rankings. A week later,...

Greetings Firefox users. I abandoned Firefox as my go to browser many years ago because of stability issues. I remain a ...
12/29/2025

Greetings Firefox users. I abandoned Firefox as my go to browser many years ago because of stability issues. I remain a fan of Mozilla however. I just don’t feel as though Firefox can keep up with all the security vulnerabilities Chrome and Edge close weekly (and even they have trouble keeping up IMO).

This article explains how a malware campaign called GhostPoster infected more than 50,000 Firefox users across 17 add-ons by hiding code inside a browser extension’s logo image. A browser extension is a small add-on that runs inside your web browser (like a VPN, translator, or ad blocker). In one example, “Free VPN Forever” (my adage applies: ‘if it’s free do some extreme vetting or run-to-the-hills and say NO!’) reads its own logo.png image file, searches the picture’s raw bytes for a marker (“===”), and then extracts and runs a hidden JavaScript code stored after the real image data. This hiding trick is called steganography in security lingo (hiding data inside a normal-looking file).

That hidden code was only a loader, meaning a small downloader whose job is to fetch the real malicious program from attacker-controlled websites. To avoid detection, it checked in only every 48 hours and usually did nothing, downloading the full payload only about 10% of the time. Once active, the malware could hijack shopping affiliate links (so criminals get the commission), add tracking to pages you visit, and remove browser safety protections (called “security headers”) that help stop clickjacking (tricking you into clicking something you did not intend).

Practical takeaway: Uninstall unfamiliar extensions, especially “free VPN” (but also recipes, weather, package tracking, driving directions, yada yada – it’s a long list and the goal is to make you forget what you once learned "there is no such thing as a free lunch" -- and trick you into installing something useful and of course "free" -- instead you need to hire a very smart professional to establish his or her vetting approach and not rubber stamp approval) -- and only install add-ons from publishers you recognize – and even that incurs a risk if their source code is infiltrated, which if very popular, *WILL BE INFILTRATED* sooner or later (that’s how cockroaches operate)!

If you suspect you installed one of these, remove it and run a full Microsoft Defender or antivirus scan and call me as there is a chance the malware will escape detection from all your efforts (BTW I’m not cheap and warning: I will point out all the issues your I/T and Security staff have and they will not like me. Kudos to Pierluigi Paganini for his SECURITY AFFAIRS MALWARE NEWSLETTER for pointing me to this interesting article.

This link will take you to a page that’s not on LinkedIn

This Forbes warning describes a new Microsoft-account takeover trick called ConsentFix, which is a twist on the older “C...
12/21/2025

This Forbes warning describes a new Microsoft-account takeover trick called ConsentFix, which is a twist on the older “ClickFix” scam. Instead of sending you to a fake login page to steal your password, attackers lure you from Google search results or a compromised site to a convincing “Cloudflare verification/CAPTCHA” screen that asks for your work email. If you type an address they’re targeting, the page tells you to click Sign In, which opens a real Microsoft sign-in page in a new tab—so it looks safe and familiar.

After you successfully sign in, Microsoft redirects your browser to a special “localhost” link that includes an authorization code. The scam’s key step is that it then instructs you to copy and paste that link back into the original page. When you do, the criminals can capture that code and trade it for access tokens, effectively taking control of your Microsoft account without stealing your password and without defeating MFA/passkeys, because you authenticated normally on Microsoft’s own site. If you ever see instructions to “fix” an issue by copying/pasting a sign-in link or code into another website, treat it as an attack and close the page or as I like to say "RUN TO THE HILLS" (meaning run as far and fast away from this sophisticated trap -- if you call me and describe what is going on I will say "RUN TO THE HILLS" or "EVERY CRIMINAL OUT THERE IS LOOKING FOR YOU TO TRICK YOU SO WHY AREN'T YOU RUNNING OUT THE DOOR TO THE HILLS AS FAR AWAY AS POSSIBLE FROM THE COMPUTER WHERE YOU WILL GET YOURSELF IN TROUBLE" :-)

Summary: Know when to RUN TO THE HILLS!

If you see this message, your Microsoft account is under attack by hackers.

I keep telling people "there is no such thing as a free lunch". That is, there are still people out there who will look...
12/21/2025

I keep telling people "there is no such thing as a free lunch". That is, there are still people out there who will look for a tool they need and find a free version of it and install it and then.. it's all over. This is called "social engineering" namely tricking you into downloading something you desire and then infecting you for years...

The article warns that criminals are spreading harmful software by tricking people in two very common places: “cracked” (pirated) software downloads and YouTube videos that promise easy installs.

In the first scheme, someone searches for a free copy of a real program (the article mentions Microsoft Word), gets sent to a file-sharing link, and downloads a ZIP file that looks legitimate. Inside the zip file is a renamed Python program (“Setup.exe”) that quietly pulls down a stealthy loader called **Count Loader**, which then stays on the computer by creating a fake-looking scheduled task (with a Google-style name) that can run repeatedly for years.

Once CountLoader is in, it can download more malware—specifically an “information stealer” (the article names ACR Stealer) designed to grab sensitive data from the computer.

The article also describes a second campaign where compromised YouTube accounts (“YouTube Ghost Network”) share videos with fake installer links that drop another loader, GachiLoader; researchers flagged about 100 videos with roughly 220,000 views. GachiLoader may request administrator permission and then try to weaken Microsoft Defender before delivering password-stealing malware (including Rhadamanthys in at least one case).

How is your free lunch doing?

Researchers uncover malware campaigns using cracked software and compromised YouTube videos to deliver CountLoader, GachiLoader, and info stealers.

This is interesting. Fortunately, this is very high-end spyware meant to target diplomats, politicians, lawyers, journa...
12/08/2025

This is interesting. Fortunately, this is very high-end spyware meant to target diplomats, politicians, lawyers, journalists, etc. I say fortunately because most of us are not among these. The spying uses "Intellexa’s Predator spyware" -- you can learn more about that sophistication from Google - https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue

https://www.ntd.com/apple-google-alert-users-to-global-spyware-hacking-campaigns_1112199.html

Commercial surveillance vendor Intellexa continues to thrive and exploit mobile zero-day vulnerabilities.

Address

McKinney, TX
75070

Website

Alerts

Be the first to know and let us send you an email when Stein Solutions posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Featured

Share