Stagefright 2.0 Vulnerabilities Affect 1 Billion Android Devices

msm1267 writes: Security researcher Joshua Drake today disclosed two more flaws in Stagefright, one that dates back to the first version of Android, and a second dependent vulnerability that was introduced in Android 5.0. The bugs affect more than one billion Android devices, essentially all of them in circulation. One of the vulnerabilities was found in a core Android library called libutils; it has been in the Android OS since it was first released and before there were even Android mobile devices. The second vulnerability was introduced into libstagefright in Android 5.0; it calls into libutils in a vulnerable way. An attacker would use a specially crafted MP3 or MP4 file in this case to exploit the vulnerabilities. Google has released patches into the Android Open Source Project tree, but public patches are not yet available. Read more of this story at Slashdot.

Originally posted here:
Stagefright 2.0 Vulnerabilities Affect 1 Billion Android Devices

Patreon Hacked, Personal Data Accessed

AmiMoJo writes: In a blog post Jake Conte, CEO and co-founder of Patreon, writes: “There was unauthorized access to registered names, email addresses, posts, and some shipping addresses. Additionally, some billing addresses that were added prior to 2014 were also accessed. We do not store full credit card numbers on our servers and no credit card numbers were compromised. Although accessed, all passwords, social security numbers and tax form information remain safely encrypted with a 2048-bit RSA key.” Read more of this story at Slashdot.

Read more here:
Patreon Hacked, Personal Data Accessed

TrueCrypt Windows encryption app has critical security flaws

If you’re still using TrueCrypt to protect your Windows disks, even though its developers abandoned it and said it was “not secure” last year, you may want to stop that. Google Project Zero researcher James Forshaw found two “privilege elevation” holes in the popular software that would give attackers full access to your data. Worse yet, TrueCrypt was audited earlier this by a crowdfunded team of iSec security researchers and found to be error-free. Google’s James Forshaw said on Twitter that the miss was understandable, though: “iSec phase 1 audit reviewed this specific code but Windows drivers are complex beasts (and) easy to miss.” Forshaw hasn’t disclosed the bugs yet, saying he usually waits seven days after a patch is released. He and other researchers agree that the vulnerabilities — which can reportedly be exploited by “abusive drive letter handling” — weren’t deliberately installed. And they won’t, of course, be fixed in the original program’s code. @v998n @VeraCrypt_IDRIX I don’t tend to open up security bug reports until 7 days or so after the release of the patch, just in case 🙂 — James Forshaw (@tiraniddo) September 27, 2015 However, if you’re using TrueCrypt because “free” is a good price, there are other options –VeraCrypt and CipherShed are open source forks of TrueCrypt, and VeraCrypt has already patched the bugs. Suffice to say, you should stop using TrueCrypt within the seven day window before Forshow releases the exploitable code. Even if you do, however, we likely haven’t heard the end of this type of Windows vulnerability. VeraCrypt’s Mounir Idrassi gold Threatpost that “These are the kind of vulnerabilities that exist in (lots of) software on Windows, ” and that will be (and have been) used by hackers for years. Via: PC World Source: James Forshaw (Twitter)

Read the original:
TrueCrypt Windows encryption app has critical security flaws

Mealworms convert Styrofoam waste into usable soil

Researchers have found a scourge for the 33 million tons of plastic dumped each year in the US: mealworms. A team from Stanford and China’s Beihang University found that the beetle larvae stay perfectly healthy eating just Styrofoam, which is normally considered non-biodegradable. Better still, the worms convert the plastic to CO2 and waste that’s safe to use as soil for crops. The scientists were as surprised by the discovery as you might be. “There’s a possibility of really important research coming out of bizarre places, ” said Stanford professor Craig Criddle. “This is a shock.” Mealworms don’t have some kind of magic digestive system, of course. Earlier research has showed that microorganisms in the stomachs of Indian mealmoths can digest the polyethylene plastic used in garbage bags. The scientists now plan to study such bacteria to see whether they can biodegrade plastics used in automotive components and microbeads that pollute water supplies. The goal is to eventually cut out the middleman (“middleworm”?) and isolate the bioenzymes used by microorganisms to break down the plastics. That could result in new methods of reducing plastic waste that’s already in the environment, and new types of bio-plastics that won’t accumulate on land or at sea. Source: Stanford University

Link:
Mealworms convert Styrofoam waste into usable soil

Newly Found TrueCrypt Flaw Allows Full System Compromise

itwbennett writes: James Forshaw, a member of Google’s Project Zero team has found a pair of flaws in the discontinued encryption utility TrueCrypt that could allow attackers to obtain elevated privileges on a system if they have access to a limited user account. ‘It’s impossible to tell if the new flaws discovered by Forshaw were introduced intentionally or not, but they do show that despite professional code audits, serious bugs can remain undiscovered, ‘ writes Lucian Constantin. Read more of this story at Slashdot.

More:
Newly Found TrueCrypt Flaw Allows Full System Compromise

Raytheon signs $1 billion contract to protect government websites

Homeland Security has signed a five-year contract with Raytheon, which could be worth a whopping $1 billion. While the defense contractor is more known for weapons development, DHS hasn’t joined forces with it to create more missiles , lasers, warheads and UAVs . No, the agency has asked the company’s help to secure government websites. According to Raytheon’s announcement , it will aid the government in developing, deploying and supporting technologies that watch out for and mitigate cyberattacks. Reuters says the company will also help around 100 agencies manage their network security within the duration of the partnership as the prime contractor for DHS’ National Cybersecurity Protection System and Network Security Deployment divisions. After that massive Office of Personnel Management hack earlier this year (and the knowledge that other .gov websites are susceptible to attacks), it’s clear that the government believes it could use the cybersecurity upgrade Raytheon promises to bring to the table. And since the White House wants to start being more aggressive in securing its networks, this isn’t the government’s only anti-cyberattack project in the works. The Pentagon, for one, is building an automated system that can detect and prevent security breaches. [Image credit: Getty Images/Caiaimage] Via: Reuters Source: Raytheon

See more here:
Raytheon signs $1 billion contract to protect government websites

Switch To Build Largest Data Center In the World In Reno

An anonymous reader writes: Data center provider Switch is planning to build a huge facility in Reno, Nevada, which it claims will be the largest data center campus in the world once completed. Switch has said that the SuperNap Reno campus will cost $3bn when fully built. The project will include seven data center buildings of the same size, totaling 6.49mn sq. ft. Read more of this story at Slashdot.

Continue reading here:
Switch To Build Largest Data Center In the World In Reno

Government Finds New Emails Clinton Did Not Hand Over

PolygamousRanchKid writes with this Reuters report that The U.S. Defense Department has found an email chain that Hillary Clinton failed to turn over to the State Department despite her saying she had provided all work emails from her time as Secretary of State.The correspondence with General David Petraeus, who was commander of U.S. Central Command at the time, started shortly before she entered office and continued during her first days as the top U.S. diplomat in January and February of 2009. News of the previously undisclosed email thread only adds to a steady stream of revelations about the emails in the past six months, which have forced Clinton to revise her account of the setup which she first gave in March. Nearly a third of all Democrats and 58 percent of all voters think Clinton is lying about her handling of her emails, according to a Fox News poll released this week. Clinton apologized this month for her email setup, saying it was unwise. But as recently as Sunday, she told CBS when asked about her emails that she provided ‘all of them.’ The emails with Petraeus also appear to contradict the claim by Clinton’s campaign that she used a private BlackBerry email account for her first two months at the department before setting up her clintonemail.com account in March 2009. This was the reason her campaign gave for not handing over any emails from those two months to the State Department. The Petraeus exchange shows she started using the clintonemail.com account by January 2009, according to the State Department. Read more of this story at Slashdot.

Originally posted here:
Government Finds New Emails Clinton Did Not Hand Over

‘Ta.co’ Bell now offers online ordering

Got a hankering for Taco Bell but just can’t bring yourself to wait the 3.5 minutes it takes to slop your order together? Well, you’re in luck. The fast food franchise chain recently debuted a new, faster way to order your Chalupas: no, not your mobile phone , the internet! The online menu is available at Ta.co (or just Tacobell.com/food if you’re unhip). Simply click on the food and drinks you want, customize each item with everything from black beans and guacamole on your Nacho Cheese Doritos Locos Tacos Supreme to Lava sauce and a three cheese blend on yourDouble Decker Taco Supreme (or other equally-silly named edible). Once you’ve finalized your order, the system will direct you to the nearest participating Taco Bell for pick up. Unfortunately, no, Taco Bell won’t also deliver it — unless you live in one of a few select cities . Via: HuffPo Source: ta.co

Read the original post:
‘Ta.co’ Bell now offers online ordering

Microsoft promises that Windows 10 doesn’t violate your privacy

Microsoft famously accused Google of ” Scroogling ” users by selling their private data to advertisers. But when it launched Windows 10, Microsoft was itself roundly criticized for over-zealous personal data collection. Critics say it does things like send parents reports of their kids’ PC use, prevent users from opting out of certain types of data collection, and scan PCs for counterfeit software. The software giant has responded to those accusations in a Windows blog post , saying that it only collects data that makes its products work better and that it gives users control over information collected. Microsoft started by addressing the “telemetry data” it collects when Windows or an app crashes. Company VP Terry Myerson explained that such info “help(s) us provide a secure and reliable experience, ” and that it “doesn’t include any of your content or files, and we take several steps to avoid collecting any information that directly identifies you.” He added that the practice has already paid off, helping a Microsoft partner fix a faulty graphics driver within 24 hours. As for personal data, Microsoft says that it only collects it to “deliver a delightful and personalized Windows experience, ” to give you updates on scores for your favorite team, for instance. Additional data is collected for features like Cortana because of its nature as a personal assistant. However, Myerson pointed out that you can opt out of collection of speech, typing, location and other activities. Finally, Redmond insists that “neither Windows 10 nor any other Microsoft software scans the contents of your email or other communications, or your files, in order to deliver targeted advertising.” In other words, Microsoft doesn’t use Outlook to create targeted advertising, unlike Google’s Gmail. As Ars Technica points out, however, the wording seems to indicate that Microsoft reserves the right to collect advertising data via other apps like Bing and Cortana. So what to make of this? Many of the original accusations were false: MIcrosoft doesn’t send your personal files to its servers like torrent sites claim, for instance. Also, it’s not new that Microsoft sends parents reports on their kids’ surfing activities — that feature was also available in Windows 8. However, Microsoft promised that it’ll update its policies to take your children’s ages into account. As for the collection of crash data, Microsoft didn’t address the actual complaint: Windows 10 users can’t opt out of telemetry, unlike with previous versions. As for the collection of crash data, Microsoft didn’t address the actual complaint; namely that Windows 10 users can’t opt out of telemetry, unlike with previous versions (unless they’re a Windows 10 Enterprise licensee). You can, however, adjust the setting from full (the default) to basic, so that you transmit less data to Microsoft. And while the company collects unique user IDs after a crash, it only does so to determine how many users are experiencing an issue. Would it be good to be able to completely opt out of telemetry? Sure! Would you trade that for a potentially more unstable operating environment? Probably not! Microsoft concluded by saying it’s listening to users’ privacy concerns, and will update its policies if need be. That’s a good start — they probably don’t bother most users, but it needs to better communicate the hows and whys of them. It would do well to keep the dialogue going, especially considering Google’s ongoing problems in privacy-mad Europe. Source: Microsoft

More:
Microsoft promises that Windows 10 doesn’t violate your privacy