Category: Applications


Apple-iconA security researcher considered to be among the foremost experts in his field says that more than a half-billion mobile devices running Apple’s latest iOS operating system contain secret backdoors.

Jonathan Zdziarski, also known by his online alias “NerveGas,” told the audience attending his Friday morning presentation at the Hackers on Planet Earth conference in New York City that around 600 million Apple devices, including iPhones and tablets, contain hidden features that allow data to be surreptitiously slurped from those devices.

During Zdziarski’s HOPE presentation, “Identifying Backdoors, Attack Points and Surveillance Mechanisms in iOS Devices,” the researcher revealed that several undocumented forensic services are installed on every new iPhone and iPad, making it easier that ever for a third-party to pull data from those devices in order to compromise a target and take hold of their personal information, including pictures, text messages, voice recordings and more.

Among the hidden functions running on iOS devices, Zdziarski said, are programs called “pcapd,” “file_relay” and “file_relay.” If used properly, he added, those programs can allow anyone with the right means and methodology to pull staggering amounts of data from a targeted phone, even when the rightful owner suspects the device is sufficiently locked.

Zdziarski has previously exploited older versions of the iOS operating system and authored several books on mobile security. Even after raising multiple questions with Apple, however, he said he has yet to figure out why, exactly, the tech giant ships iOS devices with programs that appear to do nothing other than leak digital data.

According to the slides Zdziarski presented during Friday’s talk, there’s little reason to believe the functions are used to run diagnostics or help developers.

Most services are not referenced by any known Apple software,” one slide says in part, and “the raw format of the data makes it impossible to put data back onto the phone, making useless for Genius Bar or carrier tech purposes.”

“The personal nature of the data makes it very unlikely as a debugging mechanism,” he added.

A man shows a photograph he took on his iPhone of an Apple store in Beijing

According to the researcher, evidence of the mysterious programs raises more questions than it does answers.

“Why is there a packet sniffer running on 600 million personal iOS devices instead of moved to the developer mount?” he asked in one slide. “Why are there undocumented services that bypass user backup encryption that dump mass amounts of personal data from the phone? Why is most of my user data still not encrypted with the PIN or passphrase, enabling the invasion of my personal privacy by YOU?”

“Apple really needs to step up and explain what these services are doing,” Zdziarski told Ars Technia on Monday after his HOPE presentation was hailed over the weekend by the conference’s attendees as a highlight of the three-day event. “I can’t come up with a better word than ‘backdoor’ to describe file relay, but I’m willing to listen to whatever other explanation Apple has. At the end of the day, though, there’s a lot of insecure stuff running on the phone giving up a lot of data that should never be given up. Apple really needs to fix that.”

Indeed, Apple responded on late Tuesday by saying that the tree functions in question are “diagnostic capabilities to help enterprise IT departments, developers and AppleCare troubleshoot issues.”

“Apple has, in a traditional sense, admitted to having back doors on the device specifically for their own use,” Zdziarski responded quickly on his blog. “Perhaps people misunderstand the term ‘back door’ due to the stigma Hollywood has given them, but I have never accused these ‘hidden access methods’ as being intended for anything malicious, and I’ve made repeated statements that I haven’t accused Apple of working with NSA. That doesn’t mean, however that the government can’t take advantage of back doors to access the same information. What does concern me is that Apple appears to be completely misleading about some of these (especially file relay), and not addressing the issues I raised on others.”

“I give Apple credit for acknowledging these services, and at least trying to give an answer to people who want to know why these services are there – prior to this, there was no documentation about file relay whatsoever, or its 44 data services to copy off personal data. They appear to be misleading about its capabilities, however, in downplaying them, and this concerns me,” he added.

On Apple’s part, the company said they have “never worked with any government agency from any country to create a backdoor in any of our products of services.”

 

Source: RT

Google and Microsoft have both revealed that they will integrate a ‘kill switch’ into the next versions of their smartphone operating systems, allowing customers to disable their devices if they are lost or stolen.

Google told Bloomberg that it will add a “factory reset protection solution” to its next version of Android

Meanwhile, Microsoft’s vice president for US government affairs, Fred Humphries, said that the company would be adding new anti-theft capabilities to its Find My Phone feature in Windows Phone before July 2015.

“With these additional features, we’re hopeful that technology – as part of a broader strategy – can help to further reduce incentives for criminals to steal smartphones in the first place,” Humphries said in a blog post.

The news comes after Apple introduced ‘activation lock’ and ‘delete phone’ to its Find My iPhone app in September 2013.

As a result, robberies involving the company’s products reportedly decreased by 19 per cent in New York in the first five months of this year. San Francisco and London have also seen Apple-related robberies drop.

New York attorney general Eric Schneiderman said the statistics illustrate the “stunning effectiveness of kill switches”, and has called for other smartphone companies to add theft-deterrence features to their devices.

US Senator Amy Klobuchar, a Minnesota Democrat, and Jose Serrano, a New York Democrat, have both introduced bills that would require phones sold in the US to include kill-switch technology.

Last summer, the Mayor of London Boris Johnson also wrote to eight companies – including Apple, Samsung and Google – stating that about 10,000 handsets are stolen every month in London, and manufacturers have a “corporate responsibility” to help tackle thefts.

“If we are to deter theft and help prevent crimes that victimise your customers and the residents and visitors to our city, we need meaningful engagement from business and a clear demonstration that your company is serious about your corporate responsibility to help solve this problem,” Mr Johnson told manufacturers.

“Each of your companies promote the security of your devices, their software and information they hold, but we expect the same effort to go into hardware security so that we can make a stolen handset inoperable and so eliminate the illicit second-hand market in these products.

“We hope you would support this objective. Customers and shareholders surely deserve to know that business cannot and must not benefit directly from smartphone theft through sales of replacement devices.”

Source: The Telegraph

The discovery of Heartbleed, a flaw in one of the most widespread encryption standards used online, has panicked webmasters and users alike.

The bug has gone unnoticed for more than two years and could have potentially given hackers access to an unlimited array of secure data — everything from passwords and login details to credit card numbers and addresses.

Although it’s difficult to say exactly how many websites have been exposed, the lower estimates are around 500 million with a large number of major web companies (Google, Facebook, Yahoo, etc) all forced to update their software to protect against the bug.

However, there have been quite a lot of mixed messages as to whether or not users should change their passwords, with some outlets urging that you should create new ones immediately while others are advising that you wait.

To add to the confusion there’s also been reports of hackers sending out phishing emails related to Heartbleed — in order to trick users into giving up passwords that have yet to be compromised. Be on the look out for these and don’t follow any links in suspicious looking emails – if you want to change a password go to the site directly.

Which sites are affected?
Most Google sites and services (including Gmail and YouTube – but not Chrome) were affected, as were sites maintained by Yahoo (including Tumblr and Flickr). Facebook was also hit by the bug although Twitter and LinkedIn were not.

Other big sites that have confirmed that they weren’t affected include Amazon, Hotmail and Outlook, eBay, PayPal and all of Apple’s properties — including iCloud and iTunes. If you want to check whether or not a site you use is still affected then you can do so here — just enter the URL.

Another big worry is for online banking, but thankfully we have some good news in that department. Lloyds, HSBC, RBS, Natwest, Santander and the Co-Op have all confirmed that they were not affected by the bug (they were using different encryption standards). Barclays has yet to issue a statement.

However, this does not mean that your credit card details are completely safe — as they could have been compromised via your Gmail or another third-party site. The security of mobile banking apps is still a developing situation as well.

So do I need to change my passwords?
In a word: Yes. For the sites we’ve listed above as being affected (including Gmail, Yahoo, Tumblr, Flickr, Facebook) it definitely won’t hurt to change your password some time in the next couple of weeks.

Although security experts have warned that you shouldn’t be too quick to change passwords, this is because not all website have patched their servers and changing your password before this happens could make matters worse. The sites we’ve listed above have patched their servers and if you want to check one we’ve not mentioned — click here and enter the URL.

Unfortunately, some sites (including Google) have specifically said that users don’t need to change their passwords. While it’s true that some sites are confident that they fixed the bug a while back, as most of us are guilty of changing our passwords less frequently than we should do (aka never) we think that this is as good an opportunity as ever to be a bit more security-conscious.

What should my new password be?
In lists of the most frequently used passwords online there’s some obvious clangers that we know you’re too smart to use (these include old standbys such as ’123456′ and ‘password’ itself) but just because a password doesn’t look obvious to you that doesn’t make it safe.

This means that you shouldn’t really use any single words that are found in the dictionary, any words connected to you (place of birth or pets’ names), nor should you use any obvious ‘substitutions’ (eg pa55w0rd — more complicated variations are required) or patterns derived from your keyboard layout (eg ’1qaz2wsx’ or ‘zxcvbnm’).

It’s wise to use a variety of characters in your password (including upper and lower case as well as numbers) but an easy way to get more secure is to start thinking of your password as a passphrase.

The easiest way of increasing the difficulty of a password is by simply making it longer — so try combining multiple words together and then adding in numbers between them.

You could pick a number of some significance to you (for example a loved one’s birthday, ie 12/08/1970) and then splicing this with a nonsensical phrase (‘shoesplittingwatchwizard’) to get a suitably difficulty password: Shoe12Splitting08Watch1970Wizard.

Other suggested methods for making a strong and memorable password include taking a sentence or a favourite line from a song as a starting point. So you might take the line “When you call my name it’s like a little prayer” and turn it into wuCmNilaLP. Madonna is optional of course, but we think this a fun method — especially if you can work in numbers somewhere.

You should also use different passwords for your different accounts (perhaps the most difficult piece of advice to follow of all) and if you want to be really secure you should also set up two-step authentication where available.

Ryan says: I recommend everyone on any of the sites mentioned in this article to change their passwords ASAP.

Microsoft warned on Monday of a remote code execution vulnerability (CVE-2014-1761) in Microsoft Word that is being actively exploited in targeted attacks directed at Microsoft Word 2010.

“The vulnerability could allow remote code execution if a user opens a specially crafted RTF file using an affected version of Microsoft Word, or previews or opens a specially crafted RTF email message in Microsoft Outlook while using Microsoft Word as the email viewer,” Microsoft explained in the advisory.

If successfully exploited, an attacker could gain the same user rights as the current user, Microsoft said, noting that users whose accounts are configured to have fewer user rights on the system could be less impacted than accounts with administrative privileges.

Applying the Microsoft Fix it solution, “Disable opening RTF content in Microsoft Word,” prevents the exploitation of this issue through Microsoft Word, Microsoft said.

Specifically, the issue is caused when Microsoft Word parses specially crafted RTF-formatted data causing system memory to become corrupted, giving a potential attacker the ability execute arbitrary code on the affected system.

“In a web-based attack scenario, an attacker could host a website that contains a webpage that contains a specially crafted RTF file that is used to attempt to exploit this vulnerability, Microsoft explained. “In addition, compromised websites and websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these websites. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker’s website.”

The vulnerability could be exploited through Microsoft Outlook only when using Microsoft Word as the email viewer, Microsoft warned. By default, Word is the email reader in Microsoft Outlook 2007, Microsoft Outlook 2010, and Microsoft Outlook 2013.

Microsoft did not share any details on the attacks that leveraged the vulnerability, but did credit Drew Hintz, Shane Huntley, and Matty Pellegrino of the Google Security Team for reporting it to Microsoft.

 Source: Security Week

After a never-before-seen version of KitKat has been spotted a few days ago – version KTU65 – suggesting that Google may release at least one more KitKat update before moving to a new Android OS version, a new tweet from known developer LlabTooFeR says that Android 4.4.3 may be just around the corner, with version KTU72B identified as the upcoming software update.

“Android 4.4.3 is under testing. Build number is KTU72B,” the developer wrote. “Probably it will fix known camera bug.” This KitKat version’s code name suggests this build (dated March 13) is newer than the previous one (dated March 6,) although the developer did not share any details as to when Google will actually release it.

Similarly, it’s not clear whether the update will bring any new features, on top of the expected camera fix for the Nexus 5, and whether it will be available to other devices as well. Still, this appears to be first time these newly discovered KitKat builds are associated with “Android 4.4.3.”

The latest KitKat software version available to Android users is KOT49H (Android 4.4.2), although only some devices have been updated so far, including Nexus tablets and smartphones. A recent report said that Google will unveil Android 4.5 this summer, likely together with new Nexus devices – the company is rumored to ship at least one new tablet this year, with rumors indicating that a Nexus device with an 8.9-inch may be in the works.

Source: BGR

Hundreds of open source packages, including the Red Hat, Ubuntu, and Debian distributions of Linux, are susceptible to attacks that circumvent the most widely used technology to prevent eavesdropping on the Internet, thanks to an extremely critical vulnerability in a widely used cryptographic code library.

The bug in the GnuTLS library makes it trivial for attackers to bypass secure sockets layer (SSL) and Transport Layer Security (TLS) protections available on websites that depend on the open source package. Initial estimates included in Internet discussions such as this one indicate that more than 200 different operating systems or applications rely on GnuTLS to implement crucial SSL and TLS operations, but it wouldn’t be surprising if the actual number is much higher. Web applications, e-mail programs, and other code that use the library are vulnerable to exploits that allow attackers monitoring connections to silently decode encrypted traffic passing between end users and servers.

The bug is the result of commands in a section of the GnuTLS code that verify the authenticity of TLS certificates, which are often known simply as X509 certificates. The coding error, which may have been present in the code since 2005, causes critical verification checks to be terminated, drawing ironic parallels to the extremely critical “goto fail” flaw that for months put users of Apple’s iOS and OS X operating systems at risk of surreptitious eavesdropping attacks. Apple developers have since patched the bug.

“It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification,” an advisory issued by Red Hat warned. “An attacker could use this flaw to create a specially crafted certificate that could be accepted by GnuTLS as valid for a site chosen by the attacker.”

GnuTLS developers published this bare-bones advisory that urges all users to upgrade to version 3.2.12. The flaw, formally indexed as CVE-2014-0092, is described by a GnuTLS developer as “an important (and at the same time embarrassing) bug discovered during an audit for Red Hat.” Debian’s advisory is here.

As was the case with last week’s critical encryption bug from Apple, the GnuTLS vulnerability is the result of someone making mistakes in source code that controls critical functions of the program. This time, instead of a single misplaced “goto fail” command, the mistakes involve errors with several “goto cleanup” calls. The GnuTLS program, in turn, prematurely terminates code sections that are supposed to establish secure TLS connections only after the other side presents a valid X509 certificate signed by a trusted source. Attackers can exploit the error by presenting vulnerable systems with a fraudulent certificate that is never rejected, despite its failure to pass routine security checks. The failure may allow attackers using a self-signed certificate to pose as the cryptographically authenticated operator of a vulnerable website and to decrypt protected communications. It’s significant that no one managed to notice such glaring errors, particularly since they were contained in code that anyone can review.

Security researchers are still studying the vulnerability and assessing its effect on the wide array of OSes and applications that depend on GnuTLS. For the moment, readers should assume that the severity is critical given the dizzying amount of downstream code that may be affected. One example: the apt-get installer some distributions of Linux use to distribute and update applications relies on GnuTLS, although exploits against the package can probably be caught by cryptographic code-signing of the downloaded program (thanks to readers for pointing out this secondary level of protection). Version 3 of lib-curl, which is distributed in Debian and Ubuntu, also depends on GnuTLS. Some Debian- and Ubuntu-based virtual private networking applications that work with Cisco Systems hardware are also affected. This list goes on and on.

Source: ArsTechnica

The Xbox One will add support for Dolby 5.1 and 7.1 digital audio through a post-launch patch, director of product planning Albert Penello said today.

“Dolby Digital is coming post launch,” Penello said on NeoGAF. “This was a [software] scheduling issue pure and simple, and I know people are disappointed, but we will have it.”

No timetable for the patch’s release was provided. This means that until the Xbox One audio patch is released, Microsoft’s next-generation system is not capable of doing optical audio on the level of the Xbox 360, PlayStation 3, or PlayStation 4.

Penello explained that anyone with an HDMI receiver “should be fine” because uncompressed 5.1 and 7.1 audio is passed through HDMI and DTS.

“Even if you have a Dolby only HDMI receiver (which I’m not sure exists), you will still get 5.1 or 7.1 sound since those receivers should accept uncompressed surround,” he said.

For Dolby-only headsets, Penello said he understands that these should work on Xbox One from launch, though users will only receive stereo audio.

“I have not tested this myself, but I’m told it works. Regardless, I understand this is an inconvenience, but again we’re going to have Dolby coming,” he said.

Headset company Astro, which said previously that its products would work without issue on Xbox One, released a statement on the matter following Microsoft’s announcement, confirming that because the Xbox One will not have Dolby support at launch, there will be ramifications for Astro products.

“While our products do not process DTS signals, we do have on-board Dolby encoding in both our A50 Wireless Transmitter as well as our Wired MixAmp Pro. An Xbox One gamer will need to select Stereo output for game audio, but our MixAmps will process that stereo signal with Dolby ProLogic II and encode it with Dolby Headphone,” the company said.

 

Source: GameSpot

404524-bbmIt has taken much longer than many industry watchers predicted, but Blackberry has finally gotten around to releasing a BBM app for iPhone and Android. The company has had a tough time of it lately, but maybe software is the way to keep the lights on. The app is now live in the App Store and Google Play, but there a waiting list.

BBM leaked on Android a few weeks back when the company was preparing for launch. The influx of new users caused server issues for Blackberry and delayed the launch. This is the reason for the waiting list, which most users will be subjected to. Anyone who signed up ahead of time for the service on the BBM website can log right in, but otherwise you’ll have to provide an email address and wait it out.

When you do get access, you’ll make a Blackberry ID and add your personal information. If you’ve used BBM on a Blackberry in the past, your contacts will populate immediately. If not, you’ll have to invite people. This process is different (and a bit counterintuitive) for first time users. BBM makes contact lists more secure, so you have to send the invite based on PIN, NFC pairing, or sending an email. You only get the contact added when the other party accepts the invitation.

BBM was the originator of the modern read receipt, and while that’s been replicated in both iMessage and Hangouts, BBM still does it pretty well. You can also do group chats, share pictures, and send files. It basically does all the stuff the first-part messaging clients do, but it’s running through Blackberry’s servers. If you’re worried about security, this should be on your radar.

The app is available for iPhone and Android phones. There isn’t any tablet support at this time.

Source: PC Magazine

Ryan Says: About FREAKING time!  Buh Bye WhatsApp!

Researchers from the Georgia Institute of Technology will be demonstrating a proof-of-concept method of hacking an iPhone using a malicious USB charger. Billy Lau, Yeongjin Jang, Chengyu Song announced the demonstration for Black Hat USA 2013, an annual conference for hackers and security researchers that begins on July 27th in Las Vegas.

The short version is the three researchers found a way to use USB protocols to bypass some of Apple’s security features in iOS that prevent unauthorized software from being installed on your iOS device. The three built a charger based on a BeagleBoard (see below)—a US$125 computer-on-a-circuit-board—that was able to successfully insert malware onto an iPhone plugged into it.

Worse, they can do so in under a minute.

“Despite the plethora of defense mechanisms in iOS, we successfully injected arbitrary software into current-generation Apple devices running the latest operating system (OS) software,” the researchers wrote on their BlackHat presentation description. “All users are affected, as our approach requires neither a jailbroken device nor user interaction.”

In the demonstration, they said will discuss Apple’s existing security mechanisms that protect against “arbitrary software installation,” which in layman’s terms essentially means malware. They will then describe how standard USB capabilities can be, “leveraged to bypass these defense mechanisms.” To finish it off, they will demonstrate how this same process can be used to then hide the resulting malware from the user the same way Apple hides its own built in software.

The three researchers named their malicious charger “Mactans.”

The BeagleBoard it is based on is an off-the-shelf circuit board that can be used to create all manner of tiny computing devices running Angstrom (Open Embedded), Debian, Ubuntu, and Gentoo. There are other BeagleBoard products as well, including a slightly larger model with a 1GHz Sitara ARM Cortex-A8 processors that can run Android.

The point the researchers are making is that their method can be accomplished with readily available technology.

“While Mactans was built with limited amount of time and a small budget,” they wrote, “we also briefly consider what more motivated, well-funded adversaries could accomplish.”

The researchers will offer methods for protecting yourself against such an attack—we’ll throw out that you should probably be choosy about using a charger whose provenance you can’t verify—and what Apple can do to make this attack, “substantially more difficult to pull off.”

Source: UPI

BitTorrent Inc. has opened up its Sync app to the public today. The new application is free of charge and allows people to securely sync folders to multiple devices using the BitTorrent protocol. Complete control over the storage location of the files and the absence of limits is what sets BitTorrent’s solution apart from traditional cloud based synchronization services.

Dropbox, Google Drive, Microsoft Skydrive and Mega are just a few examples of the many file-storage and backup services that are available today.

All these services rely on external cloud based hosting to back up and store files. This means that you have to trust these companies with your personal and confidential files, and that your storage space is limited.

For those people who want to be in control of their own data there haven’t been many alternatives, but BitTorrent Sync has the potential to trigger a small revolution on this front.

BitTorrent Sync’s functionality is comparable to services such as Dropbox and Skydrive, except for the fact that there’s no cloud involved. Users sync the files between their own computers and no third-party has access to it.

Besides increased security, BitTorrent sync transfers also tend to go a lot faster than competing cloud services. Another advantage is that there are no storage or transfer limits, so users can sync as many files as they want, for free.

Earlier this year BitTorrent started a closed Alpha test with a limited number of users, and today Sync is being released to the public for the first time.

“We’re really excited about opening up this Alpha. The feedback has been universally positive. Those in the closed Alpha have already synced more than 200TB since we started the program,” BitTorrent announces.

Over the past weeks many improvements have been made to the Sync application, prompted by user feedback. Among other things it is now possible to allow one-way synchronization and to exclude files or directories from being shared.

While Sync uses BitTorrent technology, people’s files are not accessible to outsiders. Only those who have the unique private key can access the shared folder.

“All the traffic is encrypted using a private key derived from the shared secret. Your files can be viewed and received only by the people with whom you share your private secret,” BitTorrent explains.

To increase security, the latest Sync version also has the option to let the secret key expire after a day so new devices can’t be added, even if outsiders have the private key.

BitTorrent stresses that Sync is still in Alpha development but tests carried out by TorrentFreak confirm that it works very well. It is an ideal tool for people who want to share large amounts of data between computers without going through third-party services.

The application is also surprisingly easy to configure. There’s no need to create an account and it only takes a few clicks to get going.

The Sync application is available for Windows, OSX, Linux and has the ability run on NAS devices through a web-interface. Readers who are interested in giving it a spin can head over to BitTorrent labs, where the Sync app can be downloaded.

Download BitTorrent Sync for Windows here.
Download BitTorrent Sync for Mac 10.6 or newer here.

Source: TorrentFreak