Stagefright 2.0 Exploits Android Vulnerabilities
Comments Off on Stagefright 2.0 Exploits Android Vulnerabilities
Newly found vulnerabilities in the way Android handles media files can allow attackers to compromise devices by tricking users into visiting maliciously crafted Web pages.
The vulnerabilities can lead to remote code execution on almost all devices that run Android, starting with version 1.0 of the OS released in 2008 to the latest 5.1.1, researchers from mobile security firm Zimperium said in a report published Thursday.
The flaws are in the way Android processes the metadata of MP3 audio files and MP4 video files, and they can be exploited when the Android system or another app that relies on Android’s media libraries previews such files.
The Zimperium researchers found similar multimedia processing flaws earlier this year in an Android library called Stagefright that could have been exploited by simply sending Android devices a maliciously crafted MMS message.
Those flaws triggered a coordinated patching effort from device manufacturers that Android’s lead security engineer, Adrian Ludwig, called the “single largest unified software update in the world.” It also contributed to Google, Samsung and LG committing to monthly security updates going forward.
One of the flaws newly discovered by Zimperium is located in a core Android library called libutils and affects almost all devices running Android versions older than 5.0 (Lollipop). The vulnerability can also be exploited in Android Lollipop (5.0 – 5.1.1) by combining it with another bug found in the Stagefright library.
The Zimperium researchers refer to the new attack as Stagefright 2.0 and believe that it affects more than 1 billion devices.
Since the previous attack vector of MMS was closed in newer versions of Google Hangouts and other messaging apps after the previous Stagefright flaws were found, the most straight-forward exploitation method for the latest vulnerabilities is through Web browsers, the Zimperium researchers said.
Zimperium reported the flaws to Google on Aug. 15 and plans to release proof-of-concept exploit code once a fix is released.
That fix will come on Oct. 5 as part of the new scheduled monthly Android security update, a Google representative said.
Source-http://www.thegurureview.net/mobile-category/stagefright-2-0-exploits-android-vulnerabilities.html
MediaTek Building Ecosystem To Power IoT
Comments Off on MediaTek Building Ecosystem To Power IoT
MediaTek is quietly building an ecosystem to drive IoT strategy to push its System on Chip shipments across multiple devices.
The fabless chipmaker is signing partnerships with Amazon, Tinitell, Apple, and People Power.
MediaTek is starting to come out of the shadows in the West with its SoC designs. It sees the IoT as a way to push more of its chips.
It has put in a tender to buy power management outfit Richtek Technology to expand its leadership in Power Management Integrated Circuits (PMIC) to strengthen its overall capabilities for the IoT business model. The deal is expected to close in Q2 2016.
It has provided funding to People Power, a user engagement company providing apps, cloud and mobile services for IoT to further accelerate its penetration in the IoT market in both the U.S. and China, develop new IoT products based on its Fabrux and Influx software architecture
Release of two software development kits (SDKs) for Apple HomeKit, the framework in iOS 8 for communicating with and controlling connected accessories in a user’s home.
This is on top of its partnership with Amazon for the latest devices – Amazon Fire TV is powered by MediaTek’s MT8173, a 64-bit quad-core processor and the world’s first multimedia SoC with ARM’s Cortex-A72 cores; Fire HD 8 and Fire HD 10 tablets powered by MT8135, an up to 1.5 GHz quad-core processor, resulting in a fast and fluid user interface, and smooth running HD videos and high frame-rate games.
Chief Marketing Officer, Johan Lodenius said the company’s cunning plan was to innvovate widely available technology that provides integrated connectivity, while investing in and nurturing developers and the maker community to deliver practical yet innovative solutions.
Source-http://www.thegurureview.net/computing-category/mediatek-building-ecosystem-to-power-iot.html
Was The Hilton Hotel Chain Hacked In April?
Comments Off on Was The Hilton Hotel Chain Hacked In April?
The Hilton organization is reportedly trying to work out whether it has been hacked and, if so, what it should do about it.
We say reportedly as we have not been able to contact Hilton ourselves and can rely only on reports. They are pretty solid reports, however, and they concern a problem at the company that happened between 21 April and 27 July.
Brian Krebs, of KrebsOnSecurity, started this off with a report about a payment card breach. Krebs said that he had heard about the breach from various sources, and that Visa – the card provider – has mailed potentially affected parties with a warning, and the news that it is the fault of a bricks and mortar company.
Visa did not name the company, but affected parties, or banks to be more precise, have uttered it to Krebs. Its name is Hilton.
“Sources at five different banks say they have now determined that the common point-of-purchase for cards included in that alert had only one commonality: they were all were used at Hilton properties, including the company’s flagship Hilton locations as well as Embassy Suites, Doubletree, Hampton Inn and Suites, and the upscale Waldorf Astoria Hotels & Resorts,” he wrote.
“It remains unclear how many Hilton properties may be affected by this apparent breach. Several sources in the financial industry told KrebsOnSecurity that the incident may date back to November 2014, and may still be ongoing.”
Krebs has a statement from the Hilton organisation in which the firm defended its security practices, and revealed that it is aware of the potential problem and is looking into it. This is a common theme among the breached, and should soon become part of mission statements.
“Hilton Worldwide is strongly committed to protecting our customers’ credit card information,” said the company in the statement to Krebs.
“We have many systems in place and work with some of the top experts in the field to address data security. Unfortunately the possibility of fraudulent credit card activity is all too common for every company in today’s marketplace. We take any potential issue very seriously, and we are looking into this matter.”
We have asked Visa and Hilton for their comments.
Source-http://www.thegurureview.net/computing-category/was-the-hilton-hotel-chain-hacked-in-april.html
Google Upgrades Voice Search
October 8, 2015 by admin
Filed under Around The Net
Comments Off on Google Upgrades Voice Search
Google said it has constructed a better neural network that is making its voice search work faster and better in noisy environments.
“We are happy to announce that our new acoustic models are now used for voice searches and commands in the Google app (on Android and iOS), and for dictation on Android devices,” Google’s Speech Team wrote in a recent blog post . “In addition to requiring much lower computational resources, the new models are more accurate, robust to noise, and faster to respond to voice search queries.”
In 2013, Google brought the same voice recognition tools that had been working in Google Now to Google Search.
Along with being able to find information on the Internet, Google Voice Search also was able to find information for users in their Gmail, Google Calendar and Google+ accounts.
At the 2013 Google I/O developers conference, Amit Singhai, today a senior vice president and Google Fellow, said the future of search is in voice. For Google, he said, future searches will be more like conversations with your computer or device, which also will be able to give you information before you even ask for it.
The company went on to make it clear that it would continue to focus on voice search.
And this week’s announcement backs that up.
Google explained in its blog post that it has updated the neural network it’s using for voice search. A neural network is a computer system based on the way the human brain and nervous system work. It generally uses many processors operating in parallel.
The improved neural network is able to consume the incoming audio in larger chunks than conventional models without performing as many calculations.
“With this, we drastically reduced computations and made the recognizer much faster,” the team wrote. “We also added artificial noise and reverberation to the training data, making the recognizer more robust to ambient noise.”
Source-http://www.thegurureview.net/aroundnet-category/google-upgrades-voice-search.html
Did Intel Deliberately Slow PC Sales?
Comments Off on Did Intel Deliberately Slow PC Sales?
Intel might have caused slow PC sales at the beginning of the year to boost the price of its Skylake chips later.
A recent study shows that the slump in PC sales in the first half was deliberately made to help Skylake sell better since August. Initially analysts believed that sales of the Skylake are hindered by existing stocks of previous Haswells, but it turns out this was untrue.
Tech Trader Daily has found that Intel significantly reduced shipments of its central processing units in the first half of the year, to leave PC maker inventories drained and empty.
This is normal practice since Intel needed to have all its PC makers and retailers with empty enough stocks in order to fill them up quickly with new Skylake models in August. But this year the plan worked too well. The Skylake stocks quickly evaporated and the first supply aps appeared between the months of August and September, with Intel quickly assuring its customers that new Skylake batches will return in stores as fast as possible.
Normally Chipzilla has a cycle of unit buildups in the first half of a financial year and then a controlled drain of units in the second half. This helps PC makers and retailers build systems in the first half and then sell them bundled without being compromised by stand-alone units selling alongside them at a higher pace in the second.
This time Intel launched the Skylake in the second half of the year, August onwards, so the cycle was stuffed up. Now it seems that this will mean a low supply of Skylakes in the first half of 2016. If you can find them, you might need to stock up now.
Intel is making piles from this. PC makers mainly build their systems on Skylakes and since the supply is low the price is high. Intel does not have to discount to shift the technology, the suppliers have to buy it at any price. Particularly as Intel’s only real x86 market, AMD, is having a bit of a snooze.
A full transition to Skylake will probably happen in winter, but the ongoing process at the moment gives Intel the much-needed money to financially buffer a slowdown in sales next spring. All this gives a warning about what will happen if AMD goes under and Intel takes total control.
Source-http://www.thegurureview.net/computing-category/did-intel-deliberately-slow-pc-sales.html
RedHat Releases Fedora 23
Red Hat has torn the roof off the sucker once again with the release of Fedora 23 in beta form.
Coming in three incredible versions, Fedora 23 Cloud, Fedora 23 Server and Fedora 23 Workstation, this new edition picks up where the old one left off and runs with it.
The biggest news for fans is the use of compiler flags to help improve security. These are designed to help protect Fedora 23 beta binaries against memory corruption vulnerabilities, buffer overflows and similar issues.
This is the latest iteration of Red Hat’s Linux-based operating system that likes to think of itself as the leading-edge open source operating system across all use cases. It’s hard to believe, but absolutely true.
The dazzling array of updates starts with Red Hat Fedora Server Beta, which offers a new role through the rolekit service in the form of a cache server for web applications, with the underlying functionality delivered by memcached.
Also new is the fact that rolekit can now be triggered by anaconda kickstart to determine what function should be started with the next reboot, and I think we can all agree that’s been a long time coming.
Cockpit also sees some big changes, including a basic cluster dashboard for Kubernetes, Support for SSH key authentication and support for configuring user accounts with their authorised keys and compatibility with multipath disks.
Meanwhile in Fedora 23 Workstation Beta, the fun keeps coming with a preview of GNOME 3.18. Changes to the software application will allow it to offer firmware updates and access to Libreoffice 5. Improvements have also been made to Wayland, with the ultimate aim being to make it the default graphic server in a future release.
Sadly, that’s where the thrillride ends as Cloud Beta contains very little new of note – but we are warned to stay tuned for news of Fedora 23 Atomic Host, said to be coming soon. We’re literally on the edge of our seats and will bring you the news as soon as we get it.
Source-http://www.thegurureview.net/computing-category/red-hat-releases-fedora-23-to-address-security-issues.html
U.S. LTE Speeds Drop
October 5, 2015 by admin
Filed under Around The Net
Comments Off on U.S. LTE Speeds Drop
The U.S. has dropped to No. 55 in LTE performance as speeds rise rapidly in countries that have lept ahead some early adopters of the popular cellular system.
The average download speed on U.S. 4G networks inched up to 10Mbps (bits per second) in the June-August quarter, according to research company OpenSignal. That was an improvement from 9Mbps in the previous quarter, but the country’s global ranking fell from 43rd as users in other countries made much larger gains.
The U.S. was one of the first countries with commercial LTE service when Verizon Wireless launched its network in late 2010. But other countries that adopted the system later started with better technology, and some have secured more frequencies or rolled out enhancements that U.S. carriers haven’t embraced as much, OpenSignal said.
New Zealand scored the highest average speed in the quarter with 36Mbps, coming up from nowhere in the rankings. But perennial standouts like South Korea and Singapore kept getting faster, too. The average LTE speed in Korea is now 29Mbps (up by 4Mbps), and in Singapore it’s 33Mbps, up by 5Mbps.
OpenSignal collects data on cellular performance through a free app that mobile subscribers can use to measure the speed they’re getting and find faster networks. The results announced Wednesday are based on readings from more than 300,000 users worldwide, the company said.
Countries like Hungary, the Dominican Republic and Morocco beat the U.S. in average LTE speed, but they aren’t necessarily smartphone paradises. Mobile users in America can use LTE more of the time, for example, because their carrier’s networks are built out. Subscribers in the U.S. are on LTE 78 percent of the time, on average, making the country No. 10 for what OpenSignal calls “time coverage.” Moroccan LTE may be fast, but 49 percent of the time, users there don’t get it, for example.
Source-http://www.thegurureview.net/mobile-category/u-s-falls-to-55th-place-worldwide-for-lte-speeds.html
Apple Finally Drops iCloud Storage Plan Prices
Comments Off on Apple Finally Drops iCloud Storage Plan Prices
For the second time in as many years, Apple dropped prices for its expanded iCloud storage plans, putting costs in line with rivals like Google, Microsoft and Dropbox.
Apple announced changes to iCloud extra storage pricing earlier this month at the event where it unveiled new iPhones, the larger iPad Pro and a revamped Apple TV.
Although the Cupertino, Calif., company did not boost the amount of free storage space — as Computerworld speculated it might — and instead continued to provide just 5GB of iCloud space gratis, it bumped up the $0.99 per month plan from 20GB to 50GB, lowered the price of the 200GB plan by 25% to $2.99 monthly, and halved the 1TB plan’s price to $9.99.
Apple also ditched last year’s 500GB plan, which had cost $9.99 monthly.
The new prices are in line with the competition; in one case, Apple’s was lower.
Google, for example, hands out 15GB of cloud-based Google Drive storage for free — triple Apple’s allowance — and charges $1.99 monthly for 100GB and $9.99 each month for 1TB. The smaller-sized plan is 33% more per gigabyte than Apple’s 200GB deal, and Google’s 1TB plan is priced the same as Apple’s.
Microsoft also gives away 15GB. Additional storage costs $1.99 monthly for 100GB — the same price as Google Drive — while 200GB runs $3.99 per month, 33% higher than Apple’s same-sized plan.
Microsoft does not sell a separate 1TB OneDrive plan but instead directs customers to Office 365 Personal, the one-user subscription to the Office application suite. As part of the subscription, customers are given 1TB of OneDrive space. Office 365 Personal costs $6.99 monthly or $69.99 annually.
Source-http://www.thegurureview.net/aroundnet-category/apple-drops-icloud-storage-plan-prices.html
Does AVG Respect Your Privacy?
AVG has been answering questions about its new privacy policy after accusations that the firm is about to sell its users down the river.
A Reddit discussion has heard from furious users who spotted that the simplified policy effectively gives the company permission to sell its mailing lists to third parties for fun and profit.
AVG stated under ‘Do You Share My Data?’ in the Q&A about the new policy, which is automatically enforced on 15 October: “Yes, though when and how we share it depends on whether it is personal data or non-personal data. AVG may share non-personal data with third parties and may publicly display aggregate or anonymous information.”
AVG has hit back at the criticism in a blog post today, by which we mean confirmed that its stance is correct, explaining: “Usage data allows [AVG] to customize the experience for customers and share data with third parties that allow them to improve or develop new products.
“Knowing that 10 million users like a certain TV program gives broadcasters the data to get producers to make more of that type of program.
“This is also how taxi firms know how to distribute their fleets, and how advertisers know where to place banners and billboards, for example. Even at AVG, we have published non-personal information that we have collected regarding app performance.”
But AVG added in big, bold type: “We do not, and will not, sell personally identifiable data to anyone, including advertisers.”
This will placate some, but others fear that the lack of choice over this matter, which requires an active decision to opt out, is too clandestine. As ever, there are threats to move to everything from Linux Mint to the Commodore 64, some more serious than others.
Several Redditors have likened it to similar warnings in Windows 10′s Insider Programme which essentially say: ‘we can track you … but we won’t, unless we do.’
Courtesy-TheInq
Is Russia Behind Recent US Malware Attacks?
Comments Off on Is Russia Behind Recent US Malware Attacks?
It would appear that while the US has been blaming China for all its cyber break-ins it appears to be ignoring Tsar Putin’s elite hacking team for the last seven years.
For the past seven years, a cyberespionage group operating out of Russia on the orders of Tsar Putin have been conducting a series of malware campaigns targeting governments, political think tanks and other organizations.
Researchers at F-Secure have been looking into the antics of an outfit called “the Dukes” which has been active since at least 2008. The group has evolved into a methodical developer of “zero-day” attacks, pulling together their own research with the published work of other security firms to provide a more detailed picture of the people behind a long-running family of malware.
The Dukes specialize in “smash and grab” attacks on networks, but have also used subtle, long-term intrusions that harvested massive amounts of data from their targets.
The group’s targets do include criminal organisations operating in the Russian Federation, which suggest there is some form of policing element to it. But they are mostly interested in Western governments and related organisations, such as government ministries and agencies, political think tanks and governmental subcontractors.
F-Secure team wrote. “Their targets have also included the governments of members of the Commonwealth of Independent States; Asian, African, and Middle Eastern governments; organisations associated with Chechen terrorism; and Russian speakers engaged in the illicit trade of controlled substances and drugs.”
The group was named after its earliest-detected malware, known as PinchDuke. Its targets were associated with the Chechen separatist movement. Later that year they were going after Western governments and organisations in search of information about the diplomatic activities of the United States and the NATO.
Most of the attacks used spear phishing emails as the means of injecting malware onto targeted systems, one of their attacks have spread malware through a malicious Tor exit node in Russia, targeting users of the anonymising network with malware injections into their downloads.
The targets have always followed Russian government interests. There are a number of Russian-language artifacts in some of the malware, including an error message in PinchDuke. GeminiDuke also used timestamps that were adjusted to match Moscow Standard time.
Before the beginning of the Ukraine crisis, the group began using a number of decoy documents in spear phishing attacks that were related to Ukraine. They included a letter undersigned by the First Deputy Minister for Foreign Affairs of Ukraine.
However, after the crisis happened the attacks dropped off suggesting that it was an intelligence gathering operation. It is also a big operation, which, if operating in Russia would most likely require state acknowledgement, if not outright support.
Source-http://www.thegurureview.net/computing-category/is-russia-behind-us-malware-attacks.html