News Prevention From Hacking : How To Protect Yourself From The Global Ransomware Attack

Security experts are bracing for more fallout from Friday's worldwide WannaCry ransomware attack, which has so far affected more than 150 countries and major businesses and organizations, including FedEx, Renault and Britain's National Health Service. But if you're just hearing about this attack - or waking up to an unresponsive computer of your own - here's what you need to understand about what law enforcement officials have called the biggest such attack in history.

-- What's ransomware?

Ransomware is a kind of malicious software that, as its name implies, takes a computer hostage and holds it for ransom. In this case, the attackers are asking for at least $300 in bitcoins for each computer affected by the attack.

With ransomware attacks, the malware locks down a target machine, encrypting its data and preventing the owner from accessing it until he or she agrees to pay up.

-- How many people have been affected by the current strain, WannaCry?

Over the weekend, Europol officials said that some 200,000 computers have been hit by the malware. But that number has almost certainly risen as people in Asia - who had logged off for the workweek before WannaCry began spreading - have returned to work. On Monday, the Japanese electronics maker Hitachi, a prominent Korean theater chain and the Chinese government said their systems had been affected. Chinese state media reported that 40,000 businesses and institutions have been hit, according to NPR, including universities, gas stations and city services.

And that's just a measure of the electronic consequences of WannaCry. The software attack has taken a toll on many people in the real world. Health care providers in Britain's NHS, for example, were forced to turn ambulances away and cancel or delay cancer treatments for patients over the weekend, though officials say 80 percent of the NHS's systems were unaffected and that the disruption is easing.

-- Are victims paying the ransom?

Some are. The news site Quartz has set up a Twitter bot to track the bitcoin wallets linked to the attack, which are growing fatter by the minute.

actual ransom tweeted: The three bitcoin wallets tied to #WannaCry ransomware have received 194 payments totaling 31.38971127 BTC ($53,453.58 USD).

-- Businesses and organizations seem to have been hit pretty hard, particularly overseas. Why?

It's largely a question of resources and attention. Security experts say the attack could have been prevented if many businesses had simply kept their machines up to date with the latest software. In reality, doing that may be more difficult than it sounds, either because of corporate cultures that don't prioritize security or because of a lack of funding to upgrade to the latest and greatest.

That raises questions about inequality in technology, said Stewart Baker, a former general counsel at the National Security Agency. Many people, he said, run pirated versions of Microsoft operating systems because they feel they cannot afford the real thing. Those people "are at risk - they're probably not getting updates," he said.

Other organizations, he said, may have stuck with legacy software because it worked and paying to upgrade to new versions of Windows didn't seem necessary.

But after the highly public spread of WannaCry, companies around the globe no longer have an excuse to forgo system updates, said one former Obama administration official.

"It's no longer a cost of doing business," said R. David Edelman, who advised President Barack Obama on technology. "It's going to be a cost of staying in business."

-- I've been hit by WannaCry. Should I pay?

Some of those who have paid the WannaCry ransom have regained control of their computers, security researchers say. Still, many are urging consumers not to pay the ransom if they can avoid it because giving in simply encourages attackers to pump out more ransomware, and victims may not get their data back even if they do pay.

Analysts have noticed an uptick of ransomware attacks in recent years, with most predicting an even bigger increase in 2017.

-- What if I don't have the luxury of fighting the ransomware?

The bad news is, you might be stuck with paying or wiping your machine and starting over from a clean install. But the next best thing you can do is help reduce the odds of being hit next time. We'll get to some tips in a minute.

-- Who's being targeted? Am I safe?

The WannaCry ransomware targets Windows computers, particularly those running Windows XP, an aging operating system that Microsoft largely stopped supporting in 2014. If you're running the most recent version of Windows, or XP with the appropriate security patches, you should be okay (though you should really stop using XP right away).

-- What about Apple and Android devices?

Apple computers appear not to be affected by WannaCry, but that does not mean that Macs or iPhones are immune to malware in general. As Apple has gained more marketshare, its products have become a much bigger target for attackers. And Android phones are notoriously susceptible to malware, in part because many Android phones run outdated versions of the system and it's incumbent on cellphone carriers to push updates. If you prefer using Android, consider switching to one of Google's proprietary handsets, such as the Pixel, which tend to receive Google's software patches as soon as they're released.

-- Who's behind the WannaCry attack?

It's unclear who the attackers are, but we do somewhat know about the origins of the ransomware. The vulnerability in Windows that WannaCry takes advantage of was discovered by the NSA for its surveillance toolkit. But word got out when a hacker group known as the Shadow Brokers dumped a bunch of leaked NSA information onto the Internet in April. Microsoft, however, had already issued a software update the month before; those that downloaded and installed the patch were protected from WannaCry, but many others lagged behind and became victims.

Microsoft is now warning that the government practice of "stockpiling" software vulnerabilities so that they can be used as weapons is a misguided tactic that weakens security for everybody.

"An equivalent scenario with conventional weapons would be the U.S. military having some of its Tomahawk missiles stolen," the company said Sunday.

-- How can I protect myself?

Bottom line: Make sure your device's software is up to date. Software updates often contain lots of patches that fix bugs and close security loopholes; regularly using Windows Update or the Software Update feature on a Mac will help insulate you from problems. But you can also set your devices to install those updates automatically so you don't even have to think about it. Hackers prey on complacency.

In addition, you can:

Create backups of your most important files, either by downloading them to an external hard drive or by storing them in a cloud-based storage service.

Use a password manager to create and keep track of unique, hard-to-remember (and thus hard-to-break) passwords for each of your services. It's a little counterintuitive, but experts say it's much more secure than the alternative, which is reusing the same password across multiple websites.

Check your medical and credit reports for evidence of fraudulent activity.

At work, check with your IT administrator to make sure your organization's devices are protected from WannaCry.

Remember to treat unexpected emails with caution, and read up on phishing - one of the most common types of social engineering attacks used by attackers to compromise machines.

"Ransomware is following the same trajectory as phishing," said Phillip Hallam-Baker, an expert at the digital security firm Comodo. "The criminals have worked out how to monetize the crime, and they know which types of businesses are likely to pay up - and how to collect the money without being caught."

Posted by Unknown Tuesday, May 16, 2017

News SmartPhones Security Update : Your Fingerprint Could Be Stolen Remotely If Your Android Phone Has A Scanner

At the Black Hat conference on Wednesday, researchers revealed that fingerprint sensors on Android phones are vulnerable to hackers.

Wiping your fingerprints won't do you any good in this day and age. During the Black Hat conference on Wednesday, security researchers presented findings that reveal hackers can remotely obtain fingerprints from Android devices that use biometric sensors.

At the moment, FireEye scientists Tao Wei and Yulong Zhang say the threat is specific to Android smartphones that use a fingerprint sensor, which limits the number of vulnerable devices. Though companies like Samsung, Huawei, and HTC currently produce Android devices with those sensors, Apple still has a significant hold on the market. Its Touch ID sensor has proven to be more secure because it encrypts data gleaned from the scanner.

"Even if the attacker can directly read the sensor, without obtaining the crypto key, [the attacker] still cannot get the fingerprint image," Zhang told ZDNet.

Android users, however, are not so lucky: The researchers detected four methods of attack, the most disconcerting of which could remotely hack the sensor and steal any fingerprint that it encounters. Called the "fingerprint sensor spying attack," it would allow a hacker to continuously use fingerprint data however they please. Wei and Zhang tested the hack on the HTC One Max and Samsung's Galaxy S5 phones.

By 2019, industry watchers predict that more than half of smartphones will have fingerprint sensors—which means phone makers must improve their device security.

Our fingerprints might not be as safe as we think they are.

New research, set to be announced at the Black Hat conference in Las Vegas on Wednesday, by FireEye researchers Tao Wei and Yulong Zhang outlined new ways to attack Android devices to extract user fingerprints.

The threat is for now confined mostly to Android devices that have fingerprint sensors, such as Samsung, Huawei, and HTC devices, which by volume remains low compared to iPhone shipments. But down the line by 2019, where it's believed that at least half of all smartphone shipments will have a fingerprint sensor, the threat deepens.

Of the four attacks outlined by the researchers, one in particular -- dubbed the "fingerprint sensor spying attack" -- can "remotely harvest fingerprints in a large scale," Zhang told ZDNet by email.

The attack, which was confirmed on the HTC One Max and Samsung's Galaxy S5, allows a hacker to stealthily acquire a fingerprint image from an affected device because device makers don't fully lock down the sensor.

Making matters worse, the sensor on some devices is only guarded by the "system" privilege instead of root, making it easier to target. (In other words: rooting or jailbreaking your phone can leave you at a greater risk.) Once the attack is in place, the fingerprint sensor can continue to quietly collect fingerprint data on anyone who uses the sensor.

"In this attack, victims' fingerprint data directly fall into attacker's hand. For the rest of the victim's life, the attacker can keep using the fingerprint data to do other malicious things," Zhang said. And that's a big problem. Fingerprints might be commonplace in mobile payments and unlocking devices, but they have been used more in the past five years also for identity, immigration, and for criminal records.

Affected vendors have since provided patches after being alerted by the researchers.

The researchers did not comment on which vendor is more secure than others. But, Zhang noted that Apple's iPhone, which pioneered the modern fingerprint sensor, is "quite secure," as it encrypts fingerprint data from the scanner.

"Even if the attacker can directly read the sensor, without obtaining the crypto key, [the attacker] still cannot get the fingerprint image," he said.

The problem isn't just limited to mobile devices. The researchers warned that many of the attacks they note in their talk also apply to high-end laptops with fingerprint sensors.

The researchers advised users to use devices that were regularly updated, and only install apps from reliable sources.

Posted by Unknown Friday, August 07, 2015

News Apple MacBook Update : Two Mac Viruses Strike At The Heart Of The Platform's Secure Image

‘Thunderstrike 2’, a worm which moves from Macbook to Macbook using hardware, joins privilege escalation bug seen in the wild for the first time.

 For years, Mac users have been safe in the knowledge that their platform was relatively safe from malware. A combination of the lower number of users on the platform, less attention from security researchers and, in general, fewer security holes in the operating system than Windows has led to a history generally free of damaging viruses and malware. So proud has Apple been of its security that it even ran several spots in its Mac vs PC ad campaign dedicated to the idea that Macs don’t get viruses.

But in quick succession, two new serious vulnerabilities in OS X have introduced Mac malware back into the conversation.

One exploits a weakness first confirmed in mid-July, which allows a malicious program that gains access to a Mac to run as though it is the administrator of the computer – a vulnerability known as “privilege escalation”. In doing so, it can bypass a lot of Apple’s security features, which rely on appropriately limiting the ability of downloaded code from affecting the deeper functions of the operating system.

Stefan Esser, the German coder who discovered the exploit, heavily criticised Apple for having already patched it in the beta versions of its next operating system, Mac OS X El Capitan. The company, which did not respond to a request for comment from the Guardian, still has not fixed the flaw in the latest current version of Mac OS, Yosemite, nor in the beta for the next Yosemite patch.

“At the moment it is unclear if Apple knows about this security problem or not, because while it is already fixed in the first betas of OS X 10.11, it is left unpatched in the current release of OS X 10.10.4 or in the current beta of OS X 10.10.5,” Esser wrote.

Later, he tweeted that “Apple was informed about said bug months ago and as usual did the irresponsible to fix it for some beta half a year in the future only.

“That means Apple released the bug via a patch … 4 months before they want to ship the ‘fix’,” he added.

Now, Esser’s bug has been seen in the wild for the first time. Researchers from Malwarebytes discovered a new adware installer doing the rounds, which allowed the adware to embed itself into the operating system, and – crucially – allowed the adware to install itself without requiring the user’s password.

Malwarebytes, which also criticises Esser for releasing the exploit without giving due notice to Apple, says: “This is obviously very bad news. Apple has evidently known about this issue for a while now … Unfortunately, Apple has not yet fixed this problem, and now it is beginning to bear fruit.”

At the same time, a very different exploit is about to be revealed to researchers at the Black Hat security conference in Las Vegas. It uses a bundle of weaknesses in the firmware of a computer, the embedded operating system which runs the lowest-level functions such as fans, power supply units, and USB ports, and lets the researchers overwrite that software with their own code, and five of these six weaknesses are present on Macs as well as PCs.

The researchers notified Apple, which has patched two of the vulnerabilities, but three remain unpatched.

Worse still, researchers managed to write a proof of concept attack which uses the weakness to create a “worm”: a virus which can spread from MacBook to MacBook directly. A deliberately infected email can infect the first MacBook, which then automatically attempts to infect any other hardware physically connected to it, such as Apple’s ethernet adapters. If that hardware is later plugged into an uninfected computer, the worm spreads further.

“People are unaware that these small cheap devices can actually infect their firmware,” researcher Xeno Kovah told Wired. “You could get a worm started all around the world that’s spreading very low and slow. If people don’t have awareness that attacks can be happening at this level then they’re going to have their guard down and an attack will be able to completely subvert their system.”

The worm, called “Thunderstrike 2”, bears a similarity to a previous proof-of-concept attack called BadUSB, which let attackers reprogram almost any USB device to attack hardware. But even that attack hadn’t been turned into a worm, limiting the potential damage.

Posted by Unknown Wednesday, August 05, 2015

News Handset Security Update : My Xperia Theft Protection Bricking Phones With Unlocked Bootloaders

Sony's My Xperia Theft Protection (MXTP) feature, which is present in recently launched handsets such as Sony Xperia Z3+, Xperia C4, Xperia Z4 Tablet and Xperia M4 Aqua, is bricking bootloader-unlocked smartphones as per user reports.

For those unaware, the MXTP security feature, when enabled, prevents a user from wiping the stolen Xperia device and installing a custom ROM without access to the owner's Google sign-in details. The main work done by MXTP here is to prevent the bootloader on the device from unlocking.

However, according to some Xperia users (via Xperia Blog), enabling the MXTP on the device that already has an unlocked bootloader, leads to the bricking of the smartphone. This is said to happen due to MXTP's efforts to prevent the bootloader-unlocking on an Xperia handset that already has an unlocked bootloader.

Sony is aware of the issue and instead of a solution, has recently changed some wording on its Unlocked Bootloader website under the 'Risks' section. The firm says that, "After unlocking your device, you should not enable My Xperia (found in the settings menu under security on some devices running Android 5.0) as this might cause the device to malfunction." The site adds, "In addition, if you have enabled My Xperia, this function must be turned off before you can unlock your device."

Notably, Sony for now does not allow consumers to unlock the bootloader on new devices including Sony Xperia Z3+, Xperia C4, Xperia Z4 Tablet and Xperia M4 Aqua. The delay is said to be the same MXTP issue, which the firm might be working on behind-the-scenes. For now, there are no custom ROMs available for the devices.

Posted by Unknown Friday, July 10, 2015

Update Mobile Security : Sammy Shoots Out Updates To Plug Mobile Keyboard Snooping Bug

Samsung has promised to deploy updates to resolve a serious mobile keyboard snooping bug, with security policy fixes expected in the coming days, the company said on Thursday – while simultaneously downplaying the issue.

As previously reported, researchers at security firm NowSecure warned that a problem involving the keyboard pre-installed with Samsung devices created a spying risk.

The risk arises from a design decision which meant updates were made over an unsecured, unencrypted HTTP connection, rather than HTTPS.

Worse yet, the update process has system-level access and the authenticity of updates isn’t checked, creating a mechanism for skilled hackers to push malware.

More than 600 million Samsung mobile devices – including the recently released Galaxy S6 – are potentially vulnerable to a greater or lesser extent.

“The Swift keyboard comes pre-installed on Samsung devices and cannot be disabled or uninstalled. Even when it is not used as the default keyboard, it can still be exploited,” an advisory by NowSecure explained.

“This can be exploited in a manner that requires no user interaction — a user does not have to explicitly choose to download a language pack update to be exploited," it added.

Remote code execution creates an open goal for attackers to snoop on Samsung devices, as third-party security experts have been quick to point out.

Paul Ducklin, a senior security advisor at Sophos, has a decent run-down of the issue here.

Sammy admitted there was a problem, while arguing that various factors make an attack difficult to pull off in practice. It said it was unaware of any exploitation, which – in any case – is guarded against by its KNOX security architecture on the latest model.

Nonetheless, the Korean consumer electronics giant will release an update, as a blog post explained.

    This vulnerability, as noted by the researchers, requires a very specific set of conditions for a hacker to be able to exploit a device this way.

    This includes the user and the hacker physically being on the same unprotected network while downloading a language update. Also, on a KNOX-protected device there are additional capabilities in place such as real-time kernel protection to prevent a malicious attack from being effective.

    So, the likelihood of making a successful attack, exploiting this vuln is low.

    There have been no reported customer cases of Galaxy devices being compromised through these keyboard updates. But as the reports indicated, the risk does exist and Samsung will roll out a security policy update in the coming days.

The issue involves Samsung's version of the app, a rebadged version of the popular SwiftKey keyboard for Android.

Downloads of SwiftKey Keyboard from Google Play or the Apple App Store are not affected by this issue, as developer SwiftKey emphasised. ®

Posted by Unknown Sunday, June 21, 2015

News Security Update : Google Has An Android Security Problem

Summary:Opinion: Security is everyone's responsibility, not just those with the cash to upgrade.

 In almost every security disclosure list, you'll usually find one company digging up the dirt on the most recent vulnerabilities: Google. The team, dubbed Project Zero, rips apart software to find and report flaws to the owner. The aim? To make the world a safer place.

And it doesn't always go well. This year alone, Google disclosed two security flaws in Microsoft's software, leaving the software giant fuming. The security team gave Microsoft three months to fix the flaw, or face public shaming. Apple's also been taken to task, with at least three zero-day flaws published ahead of its patching. (The benefit is that companies wake up and fix the flaw sooner rather than later. The obvious risk is that if it's not fixed, it's the user's problem.)

But while Google throws stones at its competitors, it's neglecting its own glass house full of users to protect.

Android remains the most popular mobile operating system in the world with over 81 percent of the worldwide market share. But only a fraction of Android's share is running the software's latest version, with the latest bug fixes, vulnerability patches, and security updates. Official stats say just shy of 10 percent are using Android 5.0 "Lollipop," with about 39 percent running the second latest version, Android 4.4 "KitKat."

That's a huge gap, but not close to even older versions. It's almost exactly split fifty-fifty down the middle between Android 4.3 and earlier -- including some 930 million devices that remain vulnerable to a security flaw Google won't fix, and Android 4.4 and later.

With about two weeks until the next version is announced -- Android "M" -- the fragmentation problem is expected to get worse. And that means security will get worse.

That's because not everyone gets the updates. Some Android devices aren't deemed compatible. That includes updates that include incremental security fixes (and features) known to mitigate malware threats and data leaks.

And it's not Google that determines who gets an upgrade. Google leaves it up to the carriers.

Carriers argue they need to test Android updates to determine whether or not a device will get an upgrade. When it's not the carriers, it's the phone makers. That's a problem because the software path is far quicker than the hardware path. Most devices will need a number of software updates over the course of their lifetimes, which usually last a year or two.

The problem is that most devices are never updated.

The one exception is Google's own brand of phones, the Nexus line-up, which remain continually updated with the latest patches and fixes. That includes the long-awaited device encryption the company promised late last year, along with Apple, in an effort to remove itself from the communications chain when the feds knock at its doors for user data.

That's where Google wins at the expense of the rest of Android's user base. Google is not at the mercy of the carriers, but does let the carriers walk all over it. As a result, Google's policy for a Nexus device versus every other device has created an ecosystem of fragmentation that affects the platform's security.

And that's entirely on Google's head. It's advantageous for the carriers to withhold software updates because they can better tempt users to buy newer devices instead. As for Google's tempting offer of upgradable Nexus devices, the company can pass itself off as a rival phone maker if it sells more than a few handfuls.

But at the end of the day, it's the users that get hurt. Android's reputation resets with the major release cycle while Android's some billion users are stuck on older versions, running buggy and flawed software that can easily be tampered with and targeted by hackers.

Posted by Unknown Saturday, May 16, 2015

News Android Update : Android 5.1 Lollipop Update Rollout Begins; Brings Device Protection And More

Google late on Monday finally announced the Android 5.1 Lollipop update, the first major update to Android Lollipop. The company in its blog announced that Android 5.1 brings stability and performance improvements.

Google also introduced some new features such as support for multiple SIM cards, Device Protection and HD voice on compatible devices with the update. The multiple SIM support seems to be primarily targeted at Android One devices. Google last month released Android One smartphones in Indonesia running Android Lollipop build 5.1 out-of-the-box.

Another highlight is built-in Device Protection, which makes sure the device is locked when lost or stolen, until signed-in using a Google account. Interestingly, Device Protection once enabled requires a Google account sign-in even if someone resets the device to factory settings.

"This feature will be available on most Android phones and tablets shipped with Android 5.1 in addition to Motorola Google Nexus 6 and HTC Google Nexus 9," notes Dave Burke, VP, Android Platform.

The Android 5.1 Lollipop update also brings high definition voice calling on the mobile phone. The HD voice calling will be available only on compatible Android 5.1 devices. Google gives example of HD voice on the Nexus 6 via T-Mobile or Verizon. Other features include ability to join Wi-Fi networks and Bluetooth paired device option directly available from Quick Settings.

Soon after announcing the Android 5.1 update, Google started pushing Android 5.1 factory images for Nexus devices. At the time of writing, the company posted factory images for the Nexus 5, Nexus 7 2012, and Nexus 10. We can expect the company to release factory images of more Nexus devices in the coming days.

Google, apart from factory images, also started uploading source code to the Android Open Source Project (AOSP). First reported by Android Police, currently Google only posted the source code of Nexus 5, Nexus 6, and Nexus 9. The publication notes, "Branches with the name lollipop-mr1-release [maintenance release 1] are starting to appear under an assortment of different projects."

Posted by Unknown Tuesday, March 10, 2015

News Top Android Update : Top Android News Of The Week - New Trojan, DIY Repair Site, And Windows App Does Android

Summary:This week in the world of Android saw news of a new site for those who want to fix their own gadgets, an easy way to run Android apps under Windows, and an Android trojan is out that works even when you think you're device is shut down.

iFixit goes full-bore with Android Repair Hub :

Chances are you've seen one of iFixit's breakdown articles for some device or another. These folks are experts at tearing open even the smallest gadgets and determining how easy they would be to repair when something goes wrong.

They've announced they are taking this expertise to the next level, with user forums sharing information to help owners repair their own gadgets. The Android Repair Hub is going strong, as they already have repair guides for 250 Android devices.

Source: Android Community

Malware discovered that works when device is off :

Security experts at AVG have discovered a vicious Android malware exploit that quietly takes over devices when installed. It is particularly insidious as it makes the device owner believe they have they have shut down their device, but in reality it keeps running although the gadget appears to be off.

The malware can make calls, send texts, and take photos while the owner believes the device is shut down.

Source: Net Security

Run Android apps on Windows PCs :

Not sure why you'd want to but those wishing to run Android apps on a Windows system can easily do so with AmiDuOS. This $10 Windows app runs Android (KitKat) that can run Android apps.

The app is easy to install, and in minutes you can be running your favorite Android apps. It supports the Amazon app store and the company has instructions for installing the Google Play store.

Source: Computerworld

Rumor: Next Samsung tablet to be thinner than iPad Air 2 :

Samsung has a big event early next month where it's expected to unveil new tablets and the Galaxy S6. A rumor based on information from insiders says one of the products to be launched is the Galaxy Tab S2.

What's interesting is that the insiders claim the new Samsung tablets will be thinner than the iPad Air 2. Samsung will supposedly offer the Tab S2 in both 8-inch and 9.7-inch versions.

Source: Sammobile

Posted by Unknown Monday, February 23, 2015

News Update Nano Technology : Robo-Wings: Military Drones That Mimic Hawks And Insects

Picking through the rubble of war-damaged buildings in combat zones, looking for enemies, survivors, booby traps or worse is one of the most dangerous jobs in the military.

To take the dirt and danger out of mopping up operations, a Pentagon agency is developing a surveillance robo-hawk that could fly through the detritus of the urban combat jungle at 45mph.

The Defense Advanced Research Projects Agency (DARPA) -- already famous as the maker of some of the U.S. military's more far-fetched war robots -- aims to develop autonomous drones small enough to fit through an open window.

Speeding through unstable buildings or threatening indoor spaces at 20 meters per second, the unmanned aerial vehicle would obviate the need for physical entry that puts troops or civilian response teams at risk. 

Part of a military brief called the Fast Lightweight Autonomy program, the study is looking at developing new algorithms to allow a small UAV operating without a remote pilot and without use of GPS waypoints to navigate stairways, corridors and other obstacles.

"Birds of prey and flying insects exhibit the kinds of capabilities we want for small UAVs," said Mark Micire, DARPA's Program Manager. "Goshawks, for example, can fly very fast through a dense forest without smacking into a tree.

"Many insects, too, can dart and hover with incredible speed and precision.

"The goal of the FLA program is to explore non-traditional perception and autonomy methods that would give small UAVs the capacity to perform in a similar way, including an ability to easily navigate tight spaces at high speed and quickly recognize if it had already been in a room before."

Ultimately, the agency says the algorithms developed in the program could enhance other types of unmanned missions, including underwater environments where GPS systems don't work.

"Urban and disaster relief operations would be obvious key beneficiaries, but applications for this technology could extend to a wide variety of missions using small and large unmanned systems linked together with manned platforms as a system of systems," said Stephanie Tompkins, director of DARPA's Defense Sciences Office.

The aim of the program would be to take the grunt work out of repetitive tasks where fatigue can mean the difference between life and death.

"By enabling unmanned systems to learn 'muscle memory' and perception for basic tasks like avoiding obstacles, it would relieve overload and stress on human operators so they can focus on supervising the systems and executing the larger mission."

Miniaturizing drones that could negotiate indoor environments has also been a focus of the U.S. military.

Its Army Research Laboratory, known as ARL, in Adelphi, Maryland, are currently working on a project to develop robotic surveillance insects with wings just 3-5 centimeters in length.

The wings are made of lead zirconium titanate, known as PZT, a material that flaps and bends when a small voltage is applied.

"We demonstrated that we can actually create lift," said Dr Ron Polcawich who heads the team. "So we know this structure has the potential to fly."

Powered by tiny ultrasonic motors that measure just 2 to 3 millimeters, the team has also designed a millipede-like robot that simulates crawling when voltage is applied to the PZT material.

While the team has shown that the project works in principle, Polcawich said that it may take a further 10-15 years of research before the Army has a fully functional robotic surveillance insect.

He said that more research would be needed to establish algorithms that would allow a robotic insect to stabilize itself.

More collaboration with other institutions -- Harvard University, for instance, has a "robo-fly" project three-times larger than the ARL's robotic insect -- would be necessary to make a fully working prototype.

Polcawich said the smaller the mechanical device, the more intricate are its aerodynamic problems.

In a gust of wind a fly "doesn't instantaneously stabilize itself," Polcawich said. "It will tumble, tumble, and then stabilize itself."

Creating this type of artificial intelligence or "cognitive ability" would take time, he said, and a number of different systems must be integrated to develop a robot that functions like an insect.

Posted by Unknown Monday, February 02, 2015

OS Update : Google Responds To Concerns Over Widespread Android WebView Vulnerability

Google has issued a statement regarding the recently reported WebView security flaw that affects devices running Android 4.3 Jelly Bean and older versions, a flaw that potentially puts over 900 million users at risk. The statement is essentially a follow-up to the Android security team's earlier response that it is up to OEMs to address the issue, and that the company has already addressed the issue with the release of Android 4.4 KitKat and Android 5.0 Lollipop.

For those who are unaware, WebView is a part of the Android OS that lets app developers render webpages in apps without requiring a full browser. The component was based on the Webkit engine, which was replaced by Google's Chromium engine when Android 4.4 KitKat launched, resolving the reported vulnerability in WebView and also enabling quick binary updates to the component via OEM updates. Android 5.0 Lollipop then unbundled WebView from the operating system, allowing it to be downloaded and updated separately by users from Google Play - without requiring an OEM fix. 

Adrian Ludwig, from Google's Android security team, in a Google+ post on Friday says Google issues bug fixes to the current version of Android on the Android Open Source Project (AOSP) page, and directly provides patches "Android partners with patches for at least the last two major versions of the operating system."

Ludwig said that improving WebView and browser security is one of the areas where the company has made the "greatest progress", detailing the changes made with Android 4.4 KitKat and Android 5.0 Lollipop. He added that it is no longer feasible to update more than 2-year-old versions of WebView, which has more than 5 million lines of code and has seen hundreds of new 'commits' a month from developers since then. Ludwig says it is up to the OEM to issue an update for the issue, ideally by updating the devices running on OS versions older than Android 4.3 Jelly Bean to Android 4.4 KitKat.

Users of Android 4.3 Jelly Bean and older devices can stay safe and unaffected by WebView bugs, Ludwig points out, by using browsers that have their own rendering engine, like Firefox or Chrome. "Using an updatable browser will protect you from currently known security issues, and since it can be updated in the future it will also protect you against any issues that might be found in the future," Ludwig added on his Google+ post.

It is the apps that open the web pages in their own inbuilt browser, which are vulnerable. Users can get rid of these apps or disable the inbuilt browser option from inside the app. Ludwig, for developers, added that they too can contribute in avoiding the WebView bug by following Google's "security best practices" and by making sure only trusted web pages with 'HTTPS' open in their applications.

To add some context, Google's latest distribution data of different versions of Android has revealed that Android 5.0 Lollipop, the latest publicly available version of Google's mobile and tablet operating system, is powering less than 0.1 percent of Android devices while Android KitKat has a total share of 39.1 percent. The distribution data of different versions of Android also revealed that Android Jelly Bean still powers the greater part of Android devices, with a combined percentage of 46 percent.

Interestingly, Google a company that says it will not be able to rollout a fix for the WebView bug to the majority of Android users has been lately publishing the OS security flaws of Microsoft and Apple, albeit after giving them 90-days to provide bug fixes. According to the latest report, Google has revealed two new flaws in Apple's OS X operating system. The search giant recently also revealed a number of security holes in Microsoft's Windows 7 and Windows 8.1 OS versions, despite Microsoft's request to hold off for a few days until the patch was rolled out.

Posted by Unknown Saturday, January 24, 2015

OS Update : Google Reveals Security Flaws In Apple's OS X Operating System

Google these past few weeks published details about security flaws in Microsoft's Windows operating system despite a request by the Redmond giant to hold off until it issued a fix within a few days, and now, the company has published details about three security flaws in Apple's OS X operating system after the stipulated Project Zero 90-day deadline to deliver a fix lapsed.

Google's Project Zero security unit has revealed three flaws in Apple's OS X operating system that might allow hackers to take control of users' Mac systems. The flaws are mentioned as "OS X networkd "effective_audit_token" XPC type confusion sandbox escape", "OS X IOKit kernel code execution due to NULL pointer dereference in IntelAccelerator," and "OS X IOKit kernel memory corruption due to bad bzero in IOBluetoothDevice." The first flaw may be mitigated by changes already present in OS X Yosemite, but that has not been confirmed. Details can be found in Google's Security Research page. 

The search giant notified Apple about the flaws back in October. However, it later published detailed information about the flaws including proof-of-concept exploit after the Project Zero team's 90-day cut-off period. Apple has still not addressed the flaws and is yet to mention if these loopholes will be tackled in future. According to iMore (via Engadget), the upcoming OS X Yosemite 10.10.2 update, currently in beta, might be able to bring fixes to the issues.

Apple's product security page states that, "For the protection of our customers, Apple does not disclose, discuss or confirm security issues until a full investigation has occurred and any necessary patches or releases are available."

As mentioned earlier, it is not the first time Google has revealed the details of security flaw of an OS version before its fix rolls out. Google earlier this month revealed a series of security flaws in Microsoft Windows 8.1, for which it was criticised by Microsoft's Senior Director of the Microsoft Security Response Center, Chris Betz. Few days later it went on to reveal two more bugs of Windows 7 and Windows 8.1 to public. While some industry watchers are espousing Google's unyielding approach to bug-fixing, others say Google is being hypocritical by not patching its recently reported Webview bug that potentially affects the majority of Android devices in the market.

Posted by Unknown Saturday, January 24, 2015

New Product Update : WhatsApp Plus Users Suspended By Official Application For 24 Hours

WhatsApp is imposing 24-hour lock-outs on people trying to access its service via an unauthorised Android app.
The Facebook-owned messaging service said that it had acted against users of WhatsApp Plus because of concerns that the program might cause private data to be leaked to third-parties.

The unofficial app offers extra ways to customise how conversations appear.

Experts say Android users should be cautious about where they download apps from.

WhatsApp recently reported it had 700 million users sending an average of 30 billion messages a day. It currently charges a $0.99 (65p) annual fee to users who sign up to the service after their first 12 months of using it.

According to one app store, WhatsApp Plus had itself been downloaded more than 35 million times since its 2012 releases by a Spanish developer, who called himself Rafalense.

Security consultant Graham Cluley said that figure sounded "surprisingly high", but acknowledged there was no independent way to verify it.

WhatsApp Plus' own website appears to be offline at this time.

But the moderator of a development community, which had supported it, used Google Plus to indicate that work on the software would now be put on hold.

"We have received a cease and desist letter from WhatsApp and we are obligated to remove all download links and unfortunately delete this community," he wrote.

"I am really sorry for this but it's out of our hands and WhatsApp has pushed us into a corner that we can't escape this time. It was a fun ride but it has come to an end.

"Deepest regards from Rafalense and me and all the WhatsApp Plus team for your support."

Twenty-four hour banx :

WhatsApp Plus offers a way to use colours and background images in chat conversations that are unavailable in the official app.

In addition, it allows users to increase the size limit on attached video and sound files and also lets them prevent others being able to see when they last logged into the service - a feature it used to charge a "donation" to unlock.

To access the features, smartphone owners must first uninstall the official WhatsApp app if it is already on their han

dsets.

"The developers of WhatsApp Plus have no relationship to WhatsApp, and we do not support WhatsApp Plus," a message on the official app's site states, explaining its crackdown.

"Please be aware that WhatsApp Plus contains source code which WhatsApp cannot guarantee as safe and that your private information is potentially being passed to third-parties without your knowledge or authorisation."

Subscribers are guided to download the official app from Google's Play store. However, even if they do so, they are told they cannot access the service for further 24 hours because they violated its terms and conditions.

'Maintaining control'

WhatsApp Plus was not available from Google Play - the Android developer's own store - but was promoted on several smaller alternatives.

"People should be careful about third-party stores," commented Dr Joss Wright from the Oxford Internet Institute. 

"There are levels of quality control that are implemented by Google, which withdraws apps that are detected as being not completely legitimate, and indeed by Apple, which is incredibly restrictive about what it allows on the iOS store.

"Such apps could bring with them security bugs."

But he added that Facebook also had other incentives to stop independent apps latching onto its WhatsApp platform.

"That could potentially prevent it from adding services later for an added cost," he said.

"Or if it wants to add adverts later and ensure they are being served to the people who should be seeing them, then that it needs to maintain control and prevent the rules that it has set from being bypassed by third-party clients

Posted by Unknown Wednesday, January 21, 2015

Web News : This List Of 2014’s Worst Passwords

The year 2014, in many respects, was all about digital security. It wasn’t just tech pundits or early adopters who were victimized – Snapchat, Target, and Sony Entertainment all showed us that no one is immune. And don’t get me started on the NSA. It’s our responsibility as internet explorers to protect ourselves. But according to SplashData’s yearly list of the worst passwords on the internet (as compiled by more than 3 million leaked passwords from 2014), we are kind of lazy about the whole “digital security” thing. At least when it comes to properly locking the gates with a strong password.

Seriously Just take a look at the full list:

1. 123456
2. password
3. 12345
4. 12345678
5. qwerty
6. 123456789
7. 1234
8. baseball
9. dragon
10. football
11. 1234567
12. monkey
13. letmein
14. abc123
15. 111111
16. mustang
17. access
18. shadow
19. master
20. michael
21. superman
22. 696969
23. 123123
24. batman
25. trustno1

Last year, ‘password’ topped the list so I guess we can find some small progress in the fact that most people are just typing integers as their passwords as opposed to robotically typing in the worst password you could ever use. Heck, we’re even using ‘dragon,’ a symbol of strength and fiery vengeance that is, sadly, also a horrible password.

There are easy ways to handle the problem of passwords. And the blame is not entirely on you — the whole password system is flawed and messy. But there are easy steps you can take to be more secure. One is using password management software to ensure that your passwords are strong enough, updated, and securely locked down and in a place you can find them.

For folks who can’t be bothered to take that step, you can still do more. Even if your password isn’t entirely random and disconnected from you personally (which is best), you can still choose your same obvious passwords and spruce them up a bit.

You can use the placement of keys on a keyboard to do this — for example, folks who use ‘123456’ or ‘qwerty’ can simply jumble those together based on the keys, making something like ‘q1w2e3r4t5′. Want to make it easier? Take something you’ll remember: “My uncle lives in Kansas” and make it your password “MyUncleLivesInKansas” and add his street address: “MyUncleLivesInKansas207.” These long, complex passwords are actually quite difficult to hack and are easy to remember. While these won’t stop great hackers from getting into your stuff, at least you’ll be taking steps to get out of the top ten.

Posted by Unknown Wednesday, January 21, 2015

Report : Apple May Replace iOS Passcodes With Image Authentication System

The apple company could be about to dump the passcode opening procedure in favor of a new picture identification system, according to a certain processing made the other day.

The suggested "Image-based Verification System" would show the picture of a unique contact on the homescreen and ask customers to recognize his or her name from a list of opportunities.

If the customer recognizes the picture (or images) properly, then they will be provided entry to the product. 

The program may be exployed to discover iOS gadgets like the iPhone and iPad, or Apple's line of iMac and MacBook computers

Break from tradition :

Traditionally, The apple company has applied the 4-digit passcode as a method of opening iOS gadgets, while user-selected security passwords allow entry to Mac computer systems.

However, The apple company has been definitely thinking for an substitute, with a range of certain filings in the last few years.

Facial identification (like Android's Face Unlock feature), a two-step glide to discover program and finger marks checking have all been described in latest patents.

Posted by Unknown Monday, February 11, 2013

India Setting Up Cyber Security Architecture: NSA

Native indian is creating nationwide online protection structure to secure details facilities and other systems, National Security Consultant (NSA) Shivshankar Menon said Thursday. "The National Security Authorities has accepted the structure in concept and we are working out the execution details with the ministries and organizations concerned, which we hope to take to cupboard for acceptance soon," said Menon, providing the 8th Raja Ramanna Funeral service Session at the state-run National Institution of Innovative Studies (NIAS) here.

The suggested structure will include tracking, qualifications and guarantee of systems by specific organizations and bodies using the law. It will also include capacity and power for functions in cyberspace."The goal is to prevent destroy, espionage and other forms of online strikes, which could hurt us. A nationwide online protection manager in the National Security Authorities secretariat will bring this work together," Menon said. 

In this perspective, Menon said the secretary of state for devices and technology is in the process of establishing a devoted rubber wafer production (fab) service to generate advanced edition of snacks for use in high-tech, delicate and vital set ups such satellite, atomic power programs, defense businesses involved in the production of weaponry, missiles and electronic combat.

"The fab service will generate semiconductor snacks used in the making of nationwide resources comprising different areas such as area, atomic, army, details systems, protection systems and data centers," he said. The structure will also secure details facilities and public systems with protection position and ability to reply to events and risks."We are lucky in having the people with skills, hard and software programs and knowledge to take up the committed project," Menon added.

Ramanna was a recognized atomic researcher and is considered as father of the Native indian atomic program of over four decades and designer of the nation's first atomic test in May 1974. He accepted away in 2004.

Posted by Unknown Tuesday, January 22, 2013

No Password Is Safe From This New 25-GPU Computer Cluster

Your really, really strong password just became a little bit easier to break.

Jeremi Gosney, founder and CEO of Stricture Consulting Group, a company that handles password-cracking, has unveiled a computer cluster boasting 25 AMD Radeon graphics cards. The cluster's horsepower allows it to make 350 billion password guesses per second again

st the NT Lan Manager (NTLM) security protocol Microsoft has used in Windows Server since 2003.

Ars Technica was first to report on the cluster.

Speaking to Ars in an e-mailed statement, Gosney said that his company's technology "can attack hashes approximately four times faster" than it previously could. Using a brute force method, the cluster is capable of guessing every single eight-character password containing letters, numbers, and symbols in 5.5 hours. If companies use LM, an earlier password option for Windows Server, the cluster can figure out a password in six minutes.

So, how does the cluster do it? According to Ars, the cluster is running Virtual OpenCL, a platform that makes the GPUs believe they're all functioning together in a desktop computer. To actually crack a password, Gosney and his team uses a free password-cracker called ocl-Hashcat Plus.

Password security continues to be a major challenge for consumers, corporations, and online services. A so-called "strong" password, which in most cases wouldn't be broken for days, if not weeks, is now easier and easier to crack with advanced tools. In other words, watch out and create as strong a password as possible.

 

Posted by Unknown Friday, December 14, 2012

Hackers Highlight Major Skype Security Hole

Skype impaired its protection password restoration function after European online hackers exposed a major defect in the service's protection.

Update: We've been touching Skype to find out more. The organization told us, "Early today we were informed of customer concerns around the protection of the protection password recast function on our website.

"This problem impacted some customers where multiple Skype records were authorized to the same current e-mail deal with. We revoked the protection password recast function momentarily today as a safety measure and have made up-dates to the protection password recast process today so that it is now functional."

Skype has said it is now getting touching customers who have been suffering from modern protection issues so if you don't hear from the organization, you should be safe.

Original story continues:

It was discovered that online hackers were able to accessibility Skype users' records with just their login name and the current e-mail deal with connected to the consideration.

The Microsoft-owned VoIP service was forced to problem a declaration recognizing the opening, saying, "We have had reviews of a new protection weeknesses problem."

Vulnerability issue :
"As a prevention step we have momentarily impaired protection password recast as we continue to examine the problem further. We apologise for the difficulty but consumer experience and safety is our first priority"

Although online hackers would need to know your Skype login name and current e-mail deal with to accessibility your consideration, those concerned are advised to change the current e-mail deal with their consideration is authorized to.

It hasn't been a particularly good week for Ms on the protection front: last night it was revealed that a 16-year-old had managed to create a model Computer virus for Windows Phone 8.

Posted by Unknown Thursday, November 15, 2012

Report : How To Find A Lost Or Stolen Smartphone

Recently added features in smartphones are making it easier for users to find their lost phones.

Question: I lost my phone. What are my options to get it back, or at least stop somebody else from using it?

Answer: One solution comes from software, another from a recent industry effort.

Most smartphones either have built-in find-my-phone features or let you add them through third-party apps. The best-known among them would have to be Apple's Find My iPhone, which will let you locate a missing phone (or iPad, iPod touch or Mac) using GPS or through nearby Wi-Fi signals as long as the gadget in question is powered on and connected to the Internet. 

You can also use this feature of Apple's iCloud service to send a message to the device's screen and lock access to the rest of its software, then wipe its storage remotely if necessary. 

It's free and it works. But Apple had to make overdue upgrades to iCloud's password-reset routines after hackers exploited them to remotely wipe tech writer Mat Honan's laptop this summer in a particularly cruel attack; that's why I no longer have this option enabled on my own Mac.

Microsoft's Windows Phone software includes a similar find-my-device feature.

Google's Android operating system, however, lacks this kind of built-in protection, so you have to add it through other apps. The Lookout Mobile Security app often gets a nod for this use; it's easy to set up, and many users already run it for protection from Android malware. 

At a minimum, Lookout's free version should do well at locating a lost phone, Its newest release adds a useful Signal Flare feature that automatically sends out the phone's location as it's about to run out of battery. In a test, it operated as promised, e-mailing a map showing a test phone's whereabouts within a block.

But to lock or wipe a phone remotely, you need to opt for Lookout's $29.99/year Premium option. And to do more than remove your Google Account and associated data from the device, you also need to opt into an "Enable Better Protection" setting that authorizes Lookout to perform a complete reset.

Neither the free or paid versions of Lookout let you send a message to the phone's screen. Although the company says it's working to add that, for now you can only alert whoever finds your phone by having it sound an alarm. The free Android Lost (thanks to PCMag.com's Jamie Lendino for recommending it) includes that option, although it doesn't offer Lookout's malware protection.

Android Lost is a little wonkier to set up, but it also offers a broader set of remote controls: You can have the phone sound a siren, send a pop-up message to its home or lock screens and even see what text messages have been sent or received. And yes, you can then nuke a phone remotely.

You don't need to own a smartphone or run a special app to benefit from a new theft-deterrence initiative among wireless carriers: the stolen-phone database launched last week by AT&T, Sprint, T-Mobile and Verizon Wireless. The idea behind that project, begun with the Federal Communications Commission and law-enforcement agencies in April, is to squelch the market for stolen phones by ensuring they can't be used again.

You should be able to report a phone as lost or stolen at your carrier's site, by calling or in one of its stores. It will then add that phone to this blacklist, locking it out from further voice or data use--on its network or anybody else's--besides calls to 911.

Tip: An old smartphone can live on as a media player:

 

If you've just upgraded to a new smartphone, you can try selling the old one to another user or to a recycling operation like Gazelle or YouRenew. Your wireless carrier may also have its own buyback program. But if it's still in decent working order, you could instead move it on to a second life as a cheapskate's iPod touch.

Like Apple's media player, a deactivated iPhone or Android device can play music, display pictures and show movies. (You'll need third-party software to sync an Android phone with a Mac or PC as easily as an iPhone can.) It will also provide Web, e-mail and app use over Wi-Fi, even if it won't be nearly as fast or as long-lived on a charge as an iPod touch. 

But a retired smartphone, like any other phone without an active account, can also still dial 911 in an emergency.

Posted by Unknown Sunday, November 11, 2012