Verizon Fixes Serious Securty Flaw In FiOS

Verizon corrected a serious vulnerability in its My FiOS mobile application that granted unfettered access to email accounts, according to a developer who found the problem.

Randy Westergren, a senior software developer with XDA Developers, looked at the Android version of My FiOS, which is used for account management, email and scheduling video recordings.

“Since Verizon has a good amount of my information, I thought it would be a good candidate for research,” Westergren wrote on his personal blog. “I was right, and the results were astonishing.”

The flaw, contained in the application’s API, could have allowed an attacker to read individual messages from a person’s Verizon inbox and even send emails from an account, he wrote.

Westergren looked at the traffic sent back and forth between My FiOS and Verizon’s servers. He found My FiOS would return the content of someone else’s email inbox by simply substituting a different user ID in a request.

He contacted Verizony, which later acknowledged the problem. Verizon issued a fix last Friday, Westergren wrote.

“Verizon’s security group seemed to immediately realize the impact of this vulnerability and took it very seriously,” Westergren wrote. “They were very responsive during this process and even arranged for a free year of FiOS Internet service as a token of their gratitude.”

Source

Twitter To Allow Monet Tweets

One of France’s largest banks is partnering with social network Twitter Inc. to allow its customers to transfer money via tweets.

The move by Groupe BPCE, France’s second largest bank by customers, coincides with Twitter’s own foray into the world of online payments as the social network seeks new sources of revenue beyond advertising.

Twitter is racing other tech giants Apple  and Facebook to get a foothold in new payment services for mobile phones or apps. They are collaborating and, in some cases, competing with banks and credit card issuers that have run the business for decades.

The bank said last month it was prepared to offer simple person-to-person money transfers via Twitter to French consumers, regardless of what bank they use, and without requiring the sender know the recipient’s banking details.

“(S-Money) offers Twitter users in France a new way to send each other money, irrespective of their bank and without having to enter the beneficiary’s bank details, with a simple tweet,” Nicolas Chatillon, chief executive of S-Money,  BPCE’s mobile payments unit, said in the statement.

Payment by tweets will be managed via the bank’s S-Money service, which allows money transfers via text message and relies on the credit-card industry’s data security standards.

BPCE and Twitter declined to provide further details ahead of a news conference in Paris later today to unveil the service.

Last month, Twitter started trials of its own new service, dubbed “Twitter Buy”,  to allow consumers to find and buy products on its social network.

The service embeds a “Twitter Buy” button inside tweets posted by more than two dozen stores, music artists and non-profits. Burberry, Home Depot, and musicians such as Pharrell and Megadeth are among the early vendors.

Twitter’s role to date has been to connect customers rather than processing payments or checking their identities.

Source

What Will Facebook Do With WhatsApp?

Facebook, which closed its acquisition of mobile messaging service WhatsApp earlier this week, has said that it has no near-term plan to make money from it.

Chief Executive Mark Zuckerberg, who is visiting India to participate in an event to boost Internet usage, refused to say much more, but it does indicate that the company has not worked out a cunning plan yet.

Facebook’s final WhatsApp acquisition price tag has risen an additional $3 billion to roughly $22 billion because of the increased value of Facebook’s stock in recent months. This means that Zuckerberg is under pressure to make a bob or two from the deal.

WhatsApp works across different types of phones, across borders, and without advertising. The app only charges a 99 cent annual subscription fee, which is waived for the first year.

Source

Sony Launches SDK For SmartEyeglass

Sony has rolled out an SDK (software development kit) for its SmartEyeglass head-mounted display, another step toward challenging Google Glass.

The glasses can connect to Android smartphones via Bluetooth and project green monochrome text or basic graphics across a field within the lenses.

Sony said it will begin sales of the eyewear to developers by March 31, the end of its fiscal year. They will be sold in Japan, the U.S. and some European countries.

The Developer Preview SDK includes an emulator, tutorials, sample code and design guidelines to make the most of the device’s hardware and sensors including an accelerometer, gyroscope and brightness sensor.

The glasses, which weigh 77 grams, are more than 85 percent transparent and include a camera that can shoot 3-megapixel images and VGA video.

Sony has emphasized that the glasses project images to a user’s natural line of sight, which differs from the Google Glass display set in a corner.

“Sony’s competitive edge lies in our achievement of a thin lens with high transparency thanks to our unique holographic light guide plate technology, which enables us to provide a bright field of vision,” a Sony spokeswoman wrote in an email.

“Furthermore, the screen size is large, and images and text are displayed from the front for both eyes (not only one eye) to facilitate easier viewing and prevent eye fatigue.”

The price for the glasses as well as availability of a consumer version are still to be decided, she added.

Bulky prototype versions of the glasses were shown at the IFA and CES electronics shows earlier this year.

Potential applications include displaying cooking instructions for chefs, running time for joggers and messages from friends.

Augmented reality-style functions are also possible, such as displaying information when a user looks at a certain bottle of wine, facial recognition or navigation information in an unfamiliar city.

Source

Acers To Launh Cheap Tablets

Acer’s latest low-cost 8-inch tablets will come to market in both Android and Windows flavors.

The Iconia Tab 8 W runs Windows on an Intel Atom Z3735G quad-core processor. It offers 8 hours of battery life, weighs 370 grams and is 9.75 millimeters thick. The 8-inch screen has a resolution of 1280 by 800 pixels.

For the $149 price tag, Acer includes a one-year subscription to the Personal version of Office 365, which includes access to Word, Excel, PowerPoint, OneNote and Outlook.

Android fans will prefer the Iconia One 8, running Android 4.4. It has the same Intel processor and screen dimensions as its Windows cousin, but is slightly lighter at 340 grams and only 8.5 millimeters thick.

Buyers can choose between 10 colors, including red, green, blue, purple and pink.

Acer also took the covers off the Iconia 10, an Android-based 10-inch tablet. The device has a quad-core processor from MediaTek. The screen is protected using Gorilla glass and has Full HD resolution. Using Dolby Digital Plus, surround sound is simulated from two-channel stereo audio headphones.

Available in black or white and with a price of $199, the Iconia Tab 10 includes a micro HDMI port and Wireless Display support for showing photos and videos on a bigger TV.

The first of the new tablets to start shipping will be the Iconia 10, available this month in the Americas and Europe, Middle East and Africa (EMEA).

The Iconia Tab 8 W will go on sale in October in EMEA and in November in the Americas.

Source

Apple Changes Policy In China

Apple Inc has started the processing of keeping the personal data of some Chinese users on servers in mainland China, marking the first time the tech giant is storing user data on Chinese soil.

The storage of user data in China represents a departure from the policies of some technology companies, notably Google Inc, which has long refused to build data centers in China due to censorship and privacy concerns.

Apple said the move was part of an effort to improve the speed and reliability of its iCloud service, which lets users store pictures, e-mail and other data. Positioning data centers as close to customers as possible means faster service.

The data will be kept on servers provided by China Telecom Corp Ltd, the country’s third-largest wireless carrier, Apple said in a statement.

“Apple takes user security and privacy very seriously,” it said. “We have added China Telecom to our list of data center providers to increase bandwidth and improve performance for our customers in mainland china. All data stored with our providers is encrypted. China Telecom does not have access to the content.”

A source with knowledge of the situation said the encryption keys for Apple’s data on China Telecom servers would be stored offshore and not made available to China Telecom.

Apple has said it has devised encryption systems for services such as iMessage that even Apple itself cannot unlock. But some experts expressed scepticism that Apple would be able to withhold user data in the event of a government request.

“If they’re making out that the data is protected and secure that’s a little disingenuous because if they want to operate a business here, that’d have to comply with demands from the authorities,” said Jeremy Goldkorn, director of Danwei.com, a research firm focused on Chinese media, internet and consumers.

“On the other hand if they don’t store Chinese user data on a Chinese server they’re basically risking a crackdown from the authorities.”

Goldkorn added that data stored in the United States is subject to similar U.S. regulations where the government can use court orders to demand private data.

A spokesman for China Telecom declined to comment.

Source

Is Epic Turla Exploiting Windows XP?

Kaspersky Lab has discovered an espionage network that successfully attacked government institutions, intelligence agencies and European companies.

The firm has dubbed the spy operation Epic Turla, and said that it is in no doubt about its capabilities.

“Over the last 10 months, Kaspersky Lab researchers have analyzed a massive cyber-espionage operation which we call ‘Epic Turla’,” it said.

“The attackers behind Epic Turla have infected several hundred computers in more than 45 countries, including government institutions, embassies, military, education, research and pharmaceutical companies.”

Kaspersky said that Epic Turla used two zero-day exploits that affected Adobe and Microsoft software, along with some backdoor and social engineering tricks.

In particular, Kaspersky said a vulnerability in Windows XP and Windows 2003 – CVE-2013-5065 – termed a “privilege escalation vulnerability” is being used. “The CVE-2013-5065 exploit allows the backdoor to achieve administrator privileges on the system and run unrestricted. This exploit only works on unpatched Microsoft Windows XP systems.”

The use of this Windows XP flaw underlines the risk that the unsupported Windows XP OS poses. Kaspersky went on to explain that, once inside, attackers install their own rootkits and other malware tools and begin their surveillance.

“Once the attackers obtain the necessary credentials without the victim noticing, they deploy the rootkit and other extreme persistence mechanisms,” it said. “The attacks are still ongoing as of July 2014, actively targeting users in Europe and the Middle East.”

The attacks are just the latest in a long line of incidents that businesses need to be aware of as cyber attacks continue at an alarming rate.

In June the security firm Crowdstrike alerted the industry to Putter Panda, a cute-sounding but nasty piece of malware. That firm pointed an accusatory finger at China and charged it with espionage on the US and Europe.

Crowdstrike CEO George Kurtz said at the time, “China’s decade-long economic espionage campaign is massive and unrelenting. Through widespread espionage campaigns, Chinese threat actors are targeting companies and governments in every part of the globe.” Chinese authorities disputed this.

The report comes in the same week Hold Security reported uncovering a huge trove of 1.2 billion web passwords and login details that have been gathered by Russian cyber criminals.

Source

FCC Mandates Text-To-911

The U.S. Federal Communications Commission voted last week to require U.S. mobile carriers and many text-messaging apps to support functionality that allows texting emergency dispatch centers, even after questions about whether the centers will be ready by the deadline.

The commission’s vote requires U.S. mobile carriers and some texting apps to put emergency text-to-911 functionality in place by the end of the year.

Even though the nation’s four largest mobile carriers have all added text-to-911 functionality this year, less than 2 percent of the nation’s 6,800 emergency dispatch centers are ready to receive texts, said Commissioner Ajit Pai. The commission’s action will give smartphone users the impression they can send text to emergency responders, when many will not be able to, he said.

The FCC’s action “encourages the public to dive into text-to-911 functionality, when in reality, there’s hardly any water in the pool,” Pai said. “The order is sure to result in massive consumer confusion, and therefore will endanger, rather than advance, public safety.”

FCC Chairman Tom Wheeler applauded the largest mobile carriers — Verizon Wireless, AT&T, Sprint and T-Mobile USA — for adding text-to-911 functionality. The agency needs to push other carriers and emergency dispatch centers, called public-safety answering points or PSAPs, to do the same, he added.

“A lot of time of has passed since [the four largest] carriers stepped up and did something voluntarily, and the other carriers serving the consumers of America did not,” he said. “If you don’t step up to your responsibility, we will.”

Smartphone users should still call 911 if possible, but text-to-911 services need to be more widely available, Wheeler said.

The adoption of text-to-911 will let smartphone users contact police and other emergency responders when it’s not safe to talk on the phone, Wheeler said. It will also aid people with hearing or speech disabilities, he noted.

“Texting is now as important a function on a mobile device as talking,” Wheeler said. “Some of those text messages are cries for help.”

Source

HTTP2 Procotol Nears Completion

When it comes to amping up traffic over the Internet, sometimes too much of a good thing may not be such a good thing at all.

The Internet Engineering Task Force is putting the final touches on HTTP/2, the second version of the Hypertext Transport Protocol (HTTP). The working group has issued a last call draft, urging interested parties to voice concerns before it becomes a full Internet specification.

Not everyone is completely satisfied with the protocol however.

“There is a lot of good in this proposed standard, but I have some deep reservations about some bad and ugly aspects of the protocol,” wrote Greg Wilkins, lead developer of the open source Jetty server software, noting his concerns in a blog item posted Monday.

Others, however, praise HTTP/2 and say it is long overdue.

“A lot of our users are experimenting with the protocol,” said Owen Garrett, head of products for server software provider NGINX. “The feedback is that generally, they have seen big performance benefits.”

First created by Web originator Tim Berners-Lee and associates, HTTP quite literally powers today’s Web, providing the language for a browser to request a Web page from a server.

Version 2.0 of HTTP, based largely on the SPDY protocol developed by Google, promises to be a better fit for how people use the Web.

“The challenge with HTTP is that it is a fairly simple protocol, and it can be quite laborious to download all the resources required to render a Web page. SPDY addresses this issue,” Garrett said.

While the first generation of Web sites were largely simple and relatively small, static documents, the Web today is used as a platform for delivering applications and bandwidth intensive real-time multimedia content.

HTTP/2 speeds basic HTTP in a number of ways. HTTP/2 allows servers to send all the different elements of a requested Web page at once, eliminating the serial sets of messages that have to be sent back and forth under plain HTTP.

HTTP/2 also allows the server and the browser to compress HTTP, which cuts the amount of data that needs to be communicated between the two.

As a result, HTTP/2 “is really useful for organization with sophisticated Web sites, particularly when its users are distributed globally or using slower networks — mobile users for instance,” Garrett said.

Source

Verizon Wins Top Honors

RootMetrics awarded Verizon Wireless its seal of approval in its latest biannual ranking of wireless network performance in cities across the U.S.

Verizon ranked first or was tied for first in 115 of 125 cities for overall network performance during the first half of 2014, leading all three other national carriers — AT&T, Sprint and T-Mobile.

Sprint didn’t finish first in any of the cities, while Verizon tied with either AT&T or T-Mobile, or both, in 56. That meant that AT&T was the only first place finisher in 59 cities, including major cities such as Cincinnati, Colorado Springs, Colo., Daytona Beach, Fla., Detroit, Los Angeles, Miami, Minneapolis, Nashville, Salt Lake City, San Antonio and Seattle.

RootMetrics found that Verizon finished first in 23 of 50 airport network evaluations for the first half of the year and tied for first in seven out of 50 airports. Verizon won or tied at four major airports: Atlanta, Chicago, Los Angeles and Denver.

Verizon has its 4G LTE network in 500 U.S. cities, providing access to 97% of the U.S. population. RootMetrics used devices capable of connecting to Verizon’s XLTE network, now operating in 300 cities.

XLTE uses AWS spectrum.

RootMetrics is an independent research company that uses testers driving in cars and in stationary locations, both indoors and outdoors, to conduct thousands of tests in each city to evaluate reliability and speed of connections and call, data and text performance. The company uses unmodified smartphones purchased off-the-shelf from operator stores.

Source

« Previous Page — Next Page »