Will Chrome’s API Work?

Google has targeted web browser settings hijacking in its latest update to Chrome for Windows.

On the Chromium blog, Google engineering director Erik Kay announced an extension settings API designed to ensure that users have notice and control over any settings changes made to their web browsers.

As a result, the only way extensions will be able to make changes to browser settings such as the default search engine and start page will be through this API.

Bargain hungry consumers are often unaware that freeware programs often bundle add-on programs for which developers receive payment but can create irritating, rather than malicious, changes to user settings.

Although there is usually consent sought at installation, quite often it is ignored or not understood, and the people who miss the warnings are generally the same ones who find it hard to change the settings back.

Kay said that the API is available in the Chromium developer channel, with a rollout to the stable channel set for May.

The Chromium stable channel has been updated to version 33.0.1750.149. The main change is an update to the embedded Flash Player for Windows, which is now version 12.0.0.77.

There are seven new security fixes, most of which were user submitted via the open source Fast Memory Detector Address Sanitizer.

Although the user community and Chrome team continue to proactively protect the Chromium project, third party extensions can still cause problems, with several already having been removed from the Chrome Store this year.

Source

Google Buys A.I. Firm

Google has purchased DeepMind Technologies, an artificial intelligence company in London, reportedly for $400 million.

A Google representative confirmed the via email, but said the company’s isn’t providing any additional information at this time.

News website Re/code said in a report this past Sunday that Google was paying $400 million for the company, founded by games prodigy and neuroscientist Demis Hassabis, Shane Legg and Mustafa Suleyman.

The company claims on its website that it combines “the best techniques from machine learning and systems neuroscience to build powerful general-purpose learning algorithms.” It said its first commercial applications are in simulations, e-commerce and games.

Google announced this month it was paying $3.2 billion in cash to acquire Nest, a maker of smart smoke alarms and thermostats, in what is seen as a bid to expand into the connected home market. It also acquired in January a security firm called Impermium, to boost its expertise in countering spam and abuse.

The Internet giant said on a research site that much of its work on language, speech, translation, and visual processing relies on machine learning and artificial intelligence. “In all of those tasks and many others, we gather large volumes of direct or indirect evidence of relationships of interest, and we apply learning algorithms to generalize from that evidence to new cases of interest,” it said.

In May, Google launched a Quantum Artificial Intelligence Lab, hosted by NASA’s Ames Research Center. The Universities Space Research Association was to invite researchers around the world to share time on the quantum computer from D-Wave Systems, to study how quantum computing can advance machine learning.

Source

Yahoo Messenger Flaw Exposed

An unpatched Yahoo Messenger vulnerability that allows hackers to change people’s status messages and possibly perform other unauthorized functons can be exploited to spam malicious links to a large number of users.

The flaw was discovered in the wild by security researchers from antivirus vendor BitDefender while investigating a customer’s report about unusual Yahoo Messenger behavior.

The flaw appears to be located in the application’s file transfer API (application programming interface) and allows attackers to send malformed requests that result in the execution of commands without any interaction from victims.

“An attacker can write a script in less than 50 lines of code to malform the message sent via the YIM protocol to the attacker,” said Bogdan Botezatu, an e-threats analysis & communication specialist at BitDefender.

“Status changing appears to be only one of the things the attacker can abuse. We’re currently investigating what other things they may achieve,” he added.

Victims are unlikely to realize that their status messages have changed and if they use version 11.5 of Yahoo Messenger, which supports tabbed conversations, they might not even spot the rogue requests, Botezatu said.

This vulnerability can be leveraged by attackers to earn money through affiliate marketing schemes by driving traffic to certain websites or to spam malicious links that point to drive-by download pages.

Source….