Tag Archive: Smartphone Repair Abbotsford


Apple has finally fixed a security flaw in its application store that for years has allowed attackers to steal passwords and install unwanted or extremely expensive applications.

The flaw arose because Apple neglected to use encryption when an iPhone or other mobile device tries to connect to the App Store, meaning an attacker can hijack the connection. In addition to a security flaw, the unencrypted connections also created a privacy vulnerability because the complete list of applications installed on the device are disclosed over Wi-Fi.

It also allows the installation of apps, including extremely expensive ones that top out at $999.99, without the user’s consent, which can create serious consequences because Apple doesn’t give refunds. To do this, an attacker needs to be on the same private or public Wi-Fi network, including, for example, a coffeeshop, hotel, or airport network.

Security researcher Elie Bursztein discovered the vulnerability and reported it to Apple last July. Apple fixed the problem in a recent update that said “content is now served over HTTPS by default.” Apple also thanked Bernhard Brehm of Recurity Labs and Rahul Iyer of Bejoi.

Bursztein, who works at Google, in Mountain View, Calif., but emphasized this was work done at home in his spare time, published a personal blog post today that described details about the App Store vulnerability and included videos of how an attacker was able to steal passwords or install unwanted apps.

Publicizing this flaw, Bursztein said, highlighted how necessary encrypted HTTPS connections were. “Many companies don’t realize that HTTPS is important for mobile apps,” he said. But if they rely on Web connections or Webviews, he added, they are vulnerable to attacks: “Providing a concrete example seems a good way to attract developer attention to the issue.”

As a postdoctoral researcher at Stanford University, Bursztein published research that included demonstrating flaws in Captchas and the Web interfaces of embedded devices. At the Defcon conference in Las Vegas two years ago, he demonstrated how to bypass Windows’ built-in encryption that Web browsers, instant messaging clients, and other programs used to store user passwords.

Bursztein’s blog post comes a day after Apple’s marketing chief, Phil Schiller, took a security-related swipe at Google on Twitter by pointing to a report on the rise of Android malware.

 

Source: CNET

Canada’s wireless carriers are targeting smartphone theft by setting up a database that will blacklist lost or stolen phones to prevent them from being reactivated.

The move would also help protect personal data on such devices, the Canadian Wireless Telecommunications Association said Thursday.

Smartphones are worth $600 to $700 and can be resold on the black market, noted association president Bernard Lord.

“With this database, it makes that a lot less attractive because the buyer of the stolen phone will not be able to connect to any network in Canada,” Lord said from Ottawa.

“It eliminates the incentive for stealing a device.”

The idea is also to reduce the black market value of a smartphone in the eyes of criminals, Lord added.

Once consumers call their wireless carrier to report their smartphone lost or stolen, the device’s internal identification number goes on the electronic blacklist.

Lord said even though more smartphones are lost than stolen, law enforcement officials have raised concerns about the issue.

The database for the Canadian wireless industry will be up and running by September 2013 and Canada’s carriers will also be contributing to an international database to help prevent smartphone theft, he said.

However, consumers who have their smartphones lost or stolen are “not off the hook” for paying their smartphone contracts.

A website will also be set up by the association to help consumers protect their smartphone data and help protect themselves from theft.

Lord said the smartphone’s ID number — called the international mobile electronic number — will be verified by carriers to make sure the device has not been lost or stolen.

The Canadian Radio-television and Telecommunications Commission congratulated the wireless industry for the initiative, but would like the database running sooner rather than later.

“I would strongly encourage the industry to implement the database before September 2013 to ensure Canadians benefit from this added protection as soon as possible,” chairman Jean-Pierre Blais said in a statement.

The creation of a database and collaboration to make sure stolen or lost devices aren’t reactivated will help make them less desirable to thieves, Blais said.

“The CRTC has been concerned for some time about reports of an increase in crimes involving lost or stolen cellphones.”

Telus said while the wireless industry, law enforcement, and regulators all have a role to play, smartphone users need to think about where they’re buying their devices.

“We ask consumers to reconsider buying phones on sites like eBay, Craigslist, or Kijiji and instead buy their devices from a verified dealer,” Telus spokesman Shawn Hall said.

“If you buy a phone from Craig’s List it might be legitimate, but it could be stolen and then you will likely be unable to get it activated,” he said.

Smartphone use in Canada is among the highest in the world and penetration has exceeded 50 per cent, Lord said.

Canada’s wireless industry will spend about $20 million on the initiative, he said.

The United States is also taking steps and will have a similar database to fight the black market for smartphones in November 2013, Lord said.

Ryan says:  This should change the market in the way deals are made on classified for sale sites.  Phones will be checked first to see if they work properly before buying.  New tricks will be implemented ie. IMEI / IMSI masking so I do not see this as a long term solution for blacklisting phones but its a move in the right direction.

Source:  CTV News

Gamers beware: Valve Software, the firm behind immensely popular gaming portal Steam, wants you to waive your right to sue before you continue gathering games using its digital distribution platform. The company has amended its subscriber agreement to stipulate that by subscribing to its service, users agree to not file lawsuits against the company. Gaming giants Microsoft (MSFT), Sony (SNE) and Electronic Arts (EA) have similar policies in place, Kotaku notes.

“It’s clear to us that in some situations, class actions have real benefits to customers,” Valve said in a statement. “In far too many cases however, class actions don’t provide any real benefit to users and instead impose unnecessary expense and delay, and are often designed to benefit the class action lawyers who craft and litigate these claims.”

The statement continued, ”Class actions like these do not benefit us or our communities. We think this new dispute resolution process is faster and better for you and Valve while avoiding unnecessary costs, and that it will therefore benefit the community as a whole.”

Source: Yahoo!

Apple, which continues to disrupt the mobile space with its patent litigation, has successfully won a case against rival Motorola, in which a photo management patent was infringed.

The German court ruling said that the “zoomed in” mode for viewing photos on Motorola’s Android handsets infringed the Apple-held patent, but not the “zoomed out” mode. EU Patent No. EP2059868 originally derived from another patent, which allowed photos to ‘bounce’ when they are over-scrolled; because people will attempt to claim anything nowadays.

FOSS Patents author Florian Mueller understands that Apple could order the destruction of devices if it chooses so.

“If Apple enforces the ruling, it can even require Motorola to destroy any infringing products in its possession in Germany and recall, at MMI’s expense, any infringing products from German retailers in order to have them destroyed as well.”

Having said that, Motorola played down the fears that devices could be subject to such ghastly ends by saying that doesn’t expect the ruling to affect future sales, and that it has “implemented a new way to view photos”, reports Bloomberg with a spelling mistake.

While Motorola can continue selling the devices, it did not comment on Mueller’s comments that would lead to ultimately the mass graves of Motorola phones. Motorola has said that it has already sought a workaround to prevent its smartphones from infringing Apple’s patent, thus rendering the court’s judgement effectively useless.

It appears from this, that not only is Germany a hot bed of patent activity, litigation — and frankly, trolling — but while one company sues another, the defendant in each case is more often than not forced to simply modify the software of the phones.

If you thought the patent wars were all in Apple’s favour, you would be wrong. It was just over a week ago when Apple pulled the plug on its iCloud and MobileMe push email feature within the borders of Germany, after Motorola won a patent claim of its own.

Source: ZDNet

Last summer, phone maker HTC raised eyebrows by announcing it would enable users to unlock the bootloaders on some of its most popular phones, enabling technically-inclined customers to root the devices and install custom operating systems or, really, any darn thing they like. Now, HTC has come through, releasing a tool to unload the bootloader on phones launched after September 2011. HTC also says it is working to make the bootloader operational on phones launched before September 2011.

The company has offered a complete list of devices currently supported by the tool. HTC notes some devices may never be supported by the unlock tool due to operator restrictions.

HTC had previously gone to some lengths to lock down bootloaders on its Android devices—partly as a defense against malicious software—but reversed course in the face of strong feedback from technically-inclined customers who feel that the ability to install their own custom operating systems is a key element of Android’s “openness.” (HTC says it was “overwhelmed by the enthusiasm of our fans.”) After all, what’s the point of an operating system being available as open source if programmers can’t download it and install it on devices?

For ambitious users, unlocking the bootloader may be a quick way to get Android 4 Ice Cream Sandwich onto HTC devices without waiting for official updates.

HTC is clear that it not officially supporting devices that have been unlocked with the bootloader, merely allowing users to unlock their devices at their own risk—and may mean they’re no longer covered by device warranties. HTC also notes that it’s possible unlocking devices may have unintended consequences, including overheating.

Ryan:  Ultimately, the main reason why I sold my HTC Desire Z and went back to BlackBerry was because of the buggy HTC Sense interface.  I am glad HTC is giving its customers more choice by allowing them to use a bootloader, “at their own risk” of course.

Source: DigitalTrends

A well-known expert on mobile phone security says a vulnerability in a widely used wireless technology could allow hackers to gain remote control of phones, instructing them to send text messages or make calls.

They could use the vulnerability in the GSM network technology, which is used by billions of people in about 80 percent of the global mobile market, to make calls or send texts to expensive, premium phone and messaging services in scams, said Karsten Nohl, head of Germany’s Security Research Labs.

Similar attacks against a small number of smartphones have been done before, but the new attack could expose any cellphone using GSM technology.

“We can do it to hundreds of thousands of phones in a short timeframe,” Nohl told Reuters in advance of a presentation at a hacking convention in Berlin on Tuesday.

Attacks on corporate landline phone systems are fairly common, often involving bogus premium-service phone lines that hackers set up across Eastern Europe, Africa and Asia. Fraudsters make calls to the numbers from hacked business phone systems or mobile phones, then collect their cash and move on before the activity is identified.

The phone users typically don’t identify the problem until after they receive their bills and telecommunications carriers often end up footing at least some of the costs.

Even though Nohl will not present details of attack at the conference he said hackers will usually replicate the code needed for attacks within a few weeks.

Source: Reuters

Bad products, horrible software and no cohesive vision have seemingly turned Research In Motion into a company without motion at this point.

Throw in a huge delay before BlackBerry 10 smartphones start shipping, and it’s clear why people are losing, or have lost, faith in a company that played a tremendous role in making the smartphone industry what it is today. Thanks to one of our most trusted sources, BGR now has new information on what’s going on inside Research In Motion, and the picture isn’t pretty.

Our source has communicated to us in no uncertain terms that PlayBook 2.0 — the next-gen tablet operating system RIM is developing — is a crystal clear window into the state of BlackBerry 10 on the upcoming smartphones RIM is building.

And the view is none too good.

“Email and PIM [is better] on an 8700 than it is on BlackBerry 10,” our contact said while talking to us about RIM’s failure to make the company’s upcoming smartphone OS work with the network infrastructure RIM is known for.

We also have more background on why RIM’s BlackBerry 10 smartphones are delayed, and it has nothing to do with a new chipset that RIM is waiting on. Our source told us that CEO Mike Lazaridis was lying when he said the company’s new lineup was delayed for that reason.

“RIM is simply pushing this out as long as they can for one reason, they don’t have a working product yet,” we were told.

At the end of our conversation, our source communicated something shocking for a high-level RIM employee to say. He told us that RIM is betting its business on a platform and ecosystem that isn’t even as good as iPhone OS 1.0 or Android 2.0. “There’s no room for a fourth ecosystem,” he stated.

 

Source: BGR / Fox News