Category: Software


Apple patches serious security holes in iOS devices

Filed under: 3G, 4G, Apple, Applications, Cybersecurity, Exploit, iOS, iPhone, iPhone Repair, Jailbreak, Repairs, Security, Software, Technology, Telecom, Unlocking, Wireless by Ryan Boese — Leave a comment
May 7, 2012

Apple has shipped a high-priority iOS update to fix multiple security holes affecting the browser used on iPhones, iPads and iPod Touch devices.

The iOS 5.1.1 update fixes four separate vulnerabilities, including one that could be used to take complete control of an affected device.

Here’s the skinny of this batch of updates:

  • A URL spoofing issue existed in Safari. This could be used in a malicious web site to direct the user to a spoofed site that visually appeared to be a legitimate domain. This issue is addressed through improved URL handling. This issue does not affect OS X systems.
  • Multiple security holes in the open-source WebKit rendering engine. These could lead to cross-site scripting attacks from maliciously crafted web sites. These vulnerabilities were used during Google’s Pwnium contest at this year’s CanSecWest conference.
  • A memory corruption issue in WebKit. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue was discovered and reported by Google’s security team.

This patch is only available via iTunes. To check that the iPhone, iPod touch, or iPad has been updated:

  1. Navigate to Settings
  2. Select General
  3. Select About. The version after applying this update will be “5.1.1″.

Ryan says: As always, do not update to 5.1.1 if your iPhone is unlocked or jailbroken already or if you plan doing this in the future.

Tags: , , , , , , , , , , , , , , , , , , ,
Comment

New iPhone app enables self-destructing sext messages

Filed under: 3G, 4G, Applications, Cybersecurity, Exploit, Internet, iPhone, Mobile, Software, Technology, Telecom, Wireless by Ryan Boese — Leave a comment
May 7, 2012

Sexting, or the act of sending sexually explicit messages or photographs between mobile phones, continues to grow increasingly popular. Mobile users often have private photos posted to the Internet without their permission, and politicians and celebrities alike have taken explicit photos that using mobile devices that were eventually leaked. Unfortunately for Anthony Weiner, the congressman wasn’t aware of an iPhone app by the name of Snapchat. The program is available for free in Apple’s App Store and allows users to send photos that self-destruct within 1-10 seconds. Images cannot be saved in the app, and Snapchat will even notify users if the recipient takes a screenshot — though there is no way to prevent screenshots from being taken, of course. It should also be noted that images are stored on the developer’s servers, and while the company “attempt(s) to delete image data as soon as possible after the message is transmitted,” it cannot guarantee messages will always be deleted. “Messages, therefore, are sent at the risk of the user,” the company’s privacy policy warns.

Source: Forbes / BGR

Tags: , , , , , , , , , , , , , , ,
Comment

Half a million Mac computers ‘infected with malware

Filed under: Applications, Computers, Cybersecurity, Exploit, Hackers, Java, Mac, Malware, PC, RootKit, Security, Software, Virus by Ryan Boese — Leave a comment
April 6, 2012

More than half a million Apple computers have been infected with the Flashback Trojan, according to a Russian anti-virus firm.

Its report claims that about 600,000 Macs have installed the malware – potentially allowing them to be hijacked and used as a “botnet”.

The firm, Dr Web, says that more than half that number are based in the US.

Apple has released a security update, but users who have not installed the patch remain exposed.

Flashback was first detected last September when anti-virus researchers flagged up software masquerading itself as a Flash Player update. Once downloaded it deactivated some of the computer’s security software.

Later versions of the malware exploited weaknesses in the Java programming language to allow the code to be installed from bogus sites without the user’s permission.

Dr Web said that once the Trojan was installed it sent a message to the intruder’s control server with a unique ID to identify the infected machine.

“By introducing the code criminals are potentially able to control the machine,” the firm’s chief executive Boris Sharov told the BBC.

“We stress the word potential as we have never seen any malicious activity since we hijacked the botnet to take it out of criminals’ hands. However, we know people create viruses to get money.

“The largest amounts of bots – based on the IP addresses we identified – are in the US, Canada, UK and Australia, so it appears to have targeted English-speaking people.”

Dr Web also notes that 274 of the infected computers it detected appeared to be located in Cupertino, California – home to Apple’s headquarters.

Java’s developer, Oracle, issued a fix to the vulnerability on 14 February, but this did not work on Macintoshes as Apple manages Java updates to its computers.

Apple released its own “security update” on Wednesday – more than eight weeks later. It can be triggered by clicking on the software update icon in the computer’s system preferences panel.

The security firm F-Secure has also posted detailed instructions about how to confirm if a machine is infected and how to remove the Trojan.

Although Apple’s system software limits the actions its computers can take without requesting their users’ permission, some security analysts suggest this latest incident highlights the fact that the machines are not invulnerable.

“People used to say that Apple computers, unlike Windows PCs, can’t ever be infected – but it’s a myth,” said Timur Tsoriev, an analyst at Kaspersky Lab.

Apple could not provide a statement at this time.

Ryan: Download Apple’s security update for the Flashback Trojan here.

Source: BBC News

Tags: , , , , , , , , , , , , , , ,
Comment

Video: Microsoft responds to Pwn2Own IE hack

Filed under: Applications, Computers, Cybersecurity, Exploit, Hackers, IE9, Internet, Software, Technology, Windows by Ryan Boese — Leave a comment
March 12, 2012

Just moments after researchers from VUPEN used two zero-day vulnerabilities to hack into the Internet Explorer 9 browser, I caught up with Mike Reavey, senior director in the Microsoft Security Response Center (MSRC) to get his response to the attack and some information on what happens next.

 

Microsoft Security Response Center (MSRC) director Mike Reavey talks about the CanSecWest Pwn2Own challenge that saw a successful exploit of two zero-day vulnerabilities in the Internet Explorer 9 browser.

Source: ZDNet

 

Tags: , , , , , , , , , ,
Comment

Rumor: Valve Building a Home Console

Filed under: Applications, Gaming, PS3, Software, Steam, XBox 360 by Ryan Boese — Leave a comment
March 4, 2012

“Well, if we have to sell hardware we will.”

That’s what Steam developer and gaming company co-founder Gabe Newell told Penny Arcade.

Anonymous sources told gaming website The Verge that Valve was working on a project that would form the center of what they’re calling “The Steam Box,” a console that could have a Core i7 CPU, 8GB of RAM, and an NVIDIA GPU. The system may be able to bridge the age-old divide between PC games and consoles by putting PC games onto living room TVs. It makes sense: hardware has proved a curious divide for too long.

And most interesting, Valve may not just be gunning against the Xbox and the Playstation. It might also be going after the probable reboot of Apple TV, and by extension, cable itself.

Newell had fighting words against the Apple model of pretty-looking devices and tight control over software, and it seems like they will be pursuing an open model along the lines of Google’s Android.

“They build a shiny sparkling thing that attracts users and then they control people’s access to those things,” Newell told The Seattle Times in a reference to Apple.

With both Xbox and Playstation continually moving away from being pure gaming systems and angling towards being all-in-one entertainment devices, and now Apple and Valve moving into the game as well, the battle for living room entertainment looks like it’s about to get much more interesting.

Source: Forbes

Tags: , , , , , , , , ,
Comment

Apple wins ‘device destroying’ injunction against Motorola

Filed under: Android, Apple, Applications, Google, iPhone, Mobile, Motorola, OS, Repairs, Software, Technology, Telecom, Wireless by Ryan Boese — Leave a comment
March 2, 2012

Apple, which continues to disrupt the mobile space with its patent litigation, has successfully won a case against rival Motorola, in which a photo management patent was infringed.

The German court ruling said that the “zoomed in” mode for viewing photos on Motorola’s Android handsets infringed the Apple-held patent, but not the “zoomed out” mode. EU Patent No. EP2059868 originally derived from another patent, which allowed photos to ‘bounce’ when they are over-scrolled; because people will attempt to claim anything nowadays.

FOSS Patents author Florian Mueller understands that Apple could order the destruction of devices if it chooses so.

“If Apple enforces the ruling, it can even require Motorola to destroy any infringing products in its possession in Germany and recall, at MMI’s expense, any infringing products from German retailers in order to have them destroyed as well.”

Having said that, Motorola played down the fears that devices could be subject to such ghastly ends by saying that doesn’t expect the ruling to affect future sales, and that it has “implemented a new way to view photos”, reports Bloomberg with a spelling mistake.

While Motorola can continue selling the devices, it did not comment on Mueller’s comments that would lead to ultimately the mass graves of Motorola phones. Motorola has said that it has already sought a workaround to prevent its smartphones from infringing Apple’s patent, thus rendering the court’s judgement effectively useless.

It appears from this, that not only is Germany a hot bed of patent activity, litigation — and frankly, trolling — but while one company sues another, the defendant in each case is more often than not forced to simply modify the software of the phones.

If you thought the patent wars were all in Apple’s favour, you would be wrong. It was just over a week ago when Apple pulled the plug on its iCloud and MobileMe push email feature within the borders of Germany, after Motorola won a patent claim of its own.

Source: ZDNet

Tags: , , , , , , , , , , , , , , , , , ,
Comment

iOS loophole gives developers access to photos, sources say a fix is coming

Filed under: Apple, Applications, Cybersecurity, Exploit, Hackers, iPhone, Jailbreak, Mobile, Repairs, Security, Software, Technology, Wireless by Ryan Boese — Leave a comment
February 29, 2012

Another day, another iOS security concern. Today’s confidence-defeating news comes from Nick Bilton at the New York Times. Bilton writes at the paper’s Bits blog that a loophole has been discovered in iOS which allows third-party developers access to your iPhone, iPad, or iPod touch’s photo and video location data… as well as the actual photos and videos themselves. It appears that if an app asks for photo location data on your device (and you approve the request for permission), that application will also be able to slurp down the photos and videos stored on your phone without any further notification. The Times report mirrors an earlier story from 9to5 Mac which detailed security issues on the platform.

Bilton had an unnamed developer create a dummy application which would replicate the offending functionality, and the developer was able to easily poach location information as well as photos and video from a test device. Other developers — such as Curio co-founder David E. Chen — sounded off on the issue. Chen told the Times that, “The location history, as well as your photos and videos, could be uploaded to a server. Once the data is off of the iOS device, Apple has virtually no ability to monitor or limit its use.” Camera+ developer John Casasanta said that, “It’s very strange, because Apple is asking for location permission, but really what it is doing is accessing your entire photo library.” The article also suggests that this loophole may have been introduced with the release of iOS 4 in 2010.

We reached out to Apple about the issue, but the company declined to comment.

All hope might not be lost, however. We spoke to sources familiar with the situation, and were informed that a fix is most likely coming for the loophole. According to the people we talked to, Apple has been made aware of the issue and is likely planning a fix with an upcoming release of iOS. Those sources also confirmed that the ability to send your photos and videos to a third-party is an error, not an intended feature. If we had to guess, the fix will likely come alongside a patch for Apple’s other recent security issue — the ability for apps to upload your address book information without warning.

This story has clear echoes of that controversy, which came to light when a developer discovered that the app Path was downloading all of your device’s contact information to the company’s servers. In a follow-up report, we discovered that Path wasn’t the only app grabbing your info.

It will be interesting to see how Apple reacts to security breaches of this nature in the future. The company has long made it clear that it’s working to respect user’s privacy; at a glance it looks like these recent slip-ups are exceptions, not the rule.

Source: The Verge

Tags: , , , , , , , , , , , , , , , , , , ,
Comment

Microsoft removes ‘Start’ button from latest Windows 8 build

Filed under: Applications, Computers, Microsoft, OS, PC, Repairs, Software, Technology, Windows, Windows 8 by Ryan Boese — 1 Comment
February 6, 2012

Do you like the Windows ‘Start’ button? Well, if you do, you’d better get used to it being gone in Windows 8 because it seems that Microsoft has removed it from the latest builds of the operating system.

Here’s a leaked screenshot from the near-final Windows 8 “Consumer Preview” version (build 8220) which comes to us via PCBeta.com:

Notice the absence of the traditional Start button? I’ve reached out to a few contacts who confirm to me that the button has indeed been removed and replaced with a hotspot in the corner that will duplicate the functionality offered by the old button.

The Start button was first introduced in Windows 95, and has been present in every version of Windows since.

Now here’s the real question … does Microsoft intend to permanently remove the Start button, or is this a trial balloon and Microsoft is looking to see what the feedback from users will be?

Source:  PCBeta

Tags: , , , , , , , , , , , , , , , , , , , , ,
Comment

Symantec says hackers stole source code in 2006

Filed under: Applications, Computers, Cybersecurity, Internet, PC, RootKit, Security, Software, Trojan, Virus by Ryan Boese — 1 Comment
January 18, 2012

Symantec Corp said a 2006 breach led to the theft of the source code to its flagship Norton security software, reversing its previous position that it had not been hacked.

The world’s biggest maker of security software had previously said that hackers stole the code from a third party, but corrected that statement on Tuesday after an investigation found that Symantec’s own networks had been infiltrated.

The unknown hackers obtained the source code, or blueprint for its software, to Norton Antivirus Corporate Edition, Norton Internet Security, Norton Utilities, Norton GoBack and pcAnywhere, Symantec spokesman Cris Paden said.

Last week, the hackers released the code to a 2006 version of Norton Utilities and have said they planned to release code to its antivirus software on Tuesday. It was not clear why the source code was being released six years after the theft.

Source code includes instructions written in computer programming languages as well as comments that engineers share to explain the design of their software. For example, a file released last week from the source code of a 2006 version of Norton Utilities included a comment that said “Make all changes in local entry, so we don’t screw up the real entry if we back up early.”

Companies typically heavily guard their source code, which is considered the crown jewels of most software makers. At some companies access is granted on an as-needed basis, with programmers allowed to view code only if it is related to the tasks they are assigned.

The reason for all the secrecy is that companies fear rivals could use the code to figure out the “secret sauce” behind their technology and that hackers could use it to plan attacks.

Paden said that the 2006 attack presented no threat to customers using the most recent versions of Symantec’s software.

“They are protected against any type of cyber attack that might materialize as a result of this code,” he said.

Yet Laura DiDio, an analyst with ITIC who helps companies evaluate security software, said that Symantec’s customers should be concerned about the potential for hackers to use the stolen source code to figure out how to defeat some of the protections in Symantec’s software.

“What we are seeing from Symantec is ‘Let’s put the best public face on this,’” she said. “Unless Symantec wrote all new code from scratch, there are going to be elements of source code in there that are still relevant today.”

Symantec said earlier this month that its own network had not been breached when the source code was taken. But Paden said on Tuesday that an investigation into the matter had revealed that the company’s networks had indeed been compromised.

“We really had to dig way back to find out that this was actually part of a source code theft,” he said. “We are still investigating exactly how it was stolen.”

Paden also said that customers of pcAnywhere, a program that facilitates remote access of PCs, may face “a slightly increased security risk” as a result of the exposure.

“Symantec is currently in the process of reaching out to our pcAnywhere customers to make them aware of the situation and to provide remediation steps to maintain the protection of their devices and information.”

Ryan: This is one of the reasons I had been telling people for years not to use Symantec programs. I knew they had been hacked because Viruses had been disabling out Norton on machines I had been fixing and I was seeing a big trend with this.

Source: Reuters / Yahoo! News

Tags: , , , , , , , , , , , , ,
Comment

Next-Gen BlackBerry Products Don’t Work, Source Says

Filed under: BBX, Blackberry, Repairs, RIM, Software, Technology, Telecom, Wireless by Ryan Boese — Leave a comment
December 22, 2011

Bad products, horrible software and no cohesive vision have seemingly turned Research In Motion into a company without motion at this point.

Throw in a huge delay before BlackBerry 10 smartphones start shipping, and it’s clear why people are losing, or have lost, faith in a company that played a tremendous role in making the smartphone industry what it is today. Thanks to one of our most trusted sources, BGR now has new information on what’s going on inside Research In Motion, and the picture isn’t pretty.

Our source has communicated to us in no uncertain terms that PlayBook 2.0 — the next-gen tablet operating system RIM is developing — is a crystal clear window into the state of BlackBerry 10 on the upcoming smartphones RIM is building.

And the view is none too good.

“Email and PIM [is better] on an 8700 than it is on BlackBerry 10,” our contact said while talking to us about RIM’s failure to make the company’s upcoming smartphone OS work with the network infrastructure RIM is known for.

We also have more background on why RIM’s BlackBerry 10 smartphones are delayed, and it has nothing to do with a new chipset that RIM is waiting on. Our source told us that CEO Mike Lazaridis was lying when he said the company’s new lineup was delayed for that reason.

“RIM is simply pushing this out as long as they can for one reason, they don’t have a working product yet,” we were told.

At the end of our conversation, our source communicated something shocking for a high-level RIM employee to say. He told us that RIM is betting its business on a platform and ecosystem that isn’t even as good as iPhone OS 1.0 or Android 2.0. “There’s no room for a fourth ecosystem,” he stated.

 

Source: BGR / Fox News
Tags: , , , , , , , , , , , , , , , , , , , , , , , ,
Comment