Tag: open source

Linux Traffic Hijack Flaw Also Affects Most Android Phones, Tablets

Zack Whittaker, writing for ZDNet: As many as 80 percent of Android devices are vulnerable to a recently disclosed Linux kernel vulnerability. Security firm Lookout said in a blog post on Monday that the flaw affects all phones and tablets that are running Android 4.4 KitKat and later, which comes with the affected Linux kernel 3.6 or newer. According to recent statistics, the number of devices affected might run past 1.4 billion phones and tablets — including devices running the Android Nougat developer preview. Windows and Macs are not affected by the vulnerability. The flaw, disclosed at the Usenix security conference last week, is complicated and difficult to exploit. If an attacker can pull off an exploit, they could inject malicious code into unencrypted web traffic from “anywhere”. However, the source and destination IP address would need to be known in order to intercept the traffic, adding to the complexity of carrying out a successful attack.The exploitability isn’t easy, though. Read more of this story at Slashdot.

Read More:
Linux Traffic Hijack Flaw Also Affects Most Android Phones, Tablets

Tesla Preps Bigger 100 KWh Battery For Model S and Model X

An anonymous reader writes: Tesla will soon offer a 100 kWh battery for the Model S and Model X that will allow for increased range — perhaps as much as 380 miles for the Model S. Currently, the 90 kWh batteries are the company’s largest capacity. Kenteken.TV is reporting that the Dutch regulator that certifies Tesla’s vehicles for use in the European Union, RDW, has recently published a number of new Tesla variants. RDW’s public database now includes entries for a Tesla “100D” and “100X, ” which are titles that follow Tesla’s current naming system based on battery capacity. The listing for the 100D claims the vehicle has a range of 381 miles or 613 kilometers. The motor output is reported as 90 kilowatts (121 horsepower), which is the maximum output the Tesla motors can sustain without overheating. Autoblog notes that EU range estimates tend to be more optimistic than those issued by the U.S. EPA. A more realistic range might be 310 to 320 miles. Read more of this story at Slashdot.

Link:
Tesla Preps Bigger 100 KWh Battery For Model S and Model X

Next Generation of Wireless — 5G — Is All Hype

Many people have promised us that 5G will be here very soon. And it will be the best thing ever. To quote Lowell McAdam, the CEO of Verizon, 5G is “wireless fiber, ” and to quote SK Telecom, thanks to 5G we will soon be able to “transfer holograms” because the upcoming standard is “100 times faster” than our current communications system 4G LTE. But if we were to quote Science, the distant future isn’t nearly as lofty as the one promised by executives. Backchannel explains: “5G” is a marketing term. There is no 5G standard — yet. The International Telecommunications Union plans to have standards ready by 2020. So for the moment “5G” refers to a handful of different kinds of technologies that are predicted, but not guaranteed, to emerge at some point in the next 3 to 7 years. (3GPP, a carrier consortium that will be contributing to the ITU process, said last year that until an actual standard exists, ‘”5G’ will remain a marketing & industry term that companies will use as they see fit.” At least they’re candid.) At the moment, advertising something as “5G” carries no greater significance than saying it’s “blazing fast” or “next generation” — nut because “5G” sounds technical, it’s good for sales. We are a long way away from actual deployment. Second, this “wireless fiber” will never happen unless we have… more fiber. Real fiber, in the form of fiber optic cables reaching businesses and homes. (This is the “last mile” problem; fiber already runs between cities.) It’s just plain physics. In order to work, 99% of any “5G” wireless deployment will have to be fiber running very close to every home and business. The high-frequency spectrum the carriers are planning to use wobbles billions of times a second but travels incredibly short distances and gets interfered with easily. So it’s great at carrying loads of information — every wobble can be imprinted with data — but can’t go very far at all. Read more of this story at Slashdot.

Follow this link:
Next Generation of Wireless — 5G — Is All Hype

Popular Sex Toy Caught Sending Intimate Data To Manufacturer

In a world where thermostats, and smart locks can be hacked, and companies covertly record information, why should sex toys remain unaffected. Fusion is reporting that the We-Vibe 4 Plus, a popular vibrator sends a range of intimate data to its manufacturer. The sex toy uses a smartphone app, which lets a use control the vibration among other things. From the report: When the device is in use, the We-Vibe 4 Plus uses its internet connectivity to regularly send information back to its manufacturer, Standard Innovations Corporation. It sends the device’s temperature every minute, and lets the manufacturer know each time a user changes the device’s vibration level. The company could easily figure out some seriously intimate personal information like when you get off, how long it takes, and with what combinations of vibes. This was revealed on Friday at hacker conference Defcon in Las Vegas by two security researchers, who wish to be called only by their handles @gOldfisk and @rancidbacon. The two examined the app’s code and the information being sent by the device over Bluetooth. In a statement sent by email, Standard Innovation Corporation’s president Frank Ferrari confirmed that the company collects this information. Read more of this story at Slashdot.

View the original here:
Popular Sex Toy Caught Sending Intimate Data To Manufacturer

Facebook Will Force Advertising On Ad-Blocking Users

Long-time reader geek writes: Facebook is going to start forcing ads to appear for all users of its desktop website, even if they use ad-blocking software (Could be paywalled; alternate source). The social network said on Tuesday that it will change the way advertising is loaded into its desktop website to make its ad units considerably more difficult for ad blockers to detect. “Facebook is ad-supported. Ads are a part of the Facebook experience; they’re not a tack on, ” said Andrew “Boz” Bosworth, Facebook’s vice president of engineering for advertising and pages. Read more of this story at Slashdot.

More:
Facebook Will Force Advertising On Ad-Blocking Users

Hackers Make the First-Ever Ransomware For Smart Thermostats

Lorenzo Franceschi-Bicchierai, writing for Motherboard: One day, your thermostat will get hacked by some cybercriminal hundreds of miles away who will lock it with malware and demand a ransom to get it back to normal, leaving you literally in the cold until you pay up a few hundred dollars. This has been a scenario that security experts have touted as one of the theoretical dangers of the rise of the Internet of Things, internet-connected devices that are often insecure. On Saturday, what sounds like a Mr. Robot plot line came one step closer to being reality, when two white hat hackers showed off the first-ever ransomware that works against a “smart” device, in this case, a thermostat. Luckily, Andrew Tierney and Ken Munro, the two security researchers who created the ransomware, actually have no ill intention. They just wanted to make a point: some Internet of Things devices fail to take simple security precautions, leaving users in danger. “We don’t have any control over our devices, and don’t really know what they’re doing and how they’re doing it, ” Tierney told Motherboard. “And if they start doing something you don’t understand, you don’t really have a way of dealing with it.” Tierney and Munro, who both work UK-based security firm Pen Test Partners, demonstrated their thermostat ransomware proof-of-concept at the hacking conference Def Con on Saturday, fulfilling the pessimistic predictions of some people in security world. Read more of this story at Slashdot.

Original post:
Hackers Make the First-Ever Ransomware For Smart Thermostats

Linux Kernel 4.8 Adds Microsoft Surface 3 Support

Brian Fagioli, writing for BetaNews:If you are a Windows user, and want a really great computer, you should consider Microsoft’s Surface line. Not only do they serve as wonderful tablets, but with the keyboard attachment, they can be solid laptops too. While many Linux users dislike Microsoft, some of them undoubtedly envy Windows hardware. While it is possible to run Linux distros on some Surface tablets, not everything will work flawlessly. Today, release candidate 1 of Linux Kernel 4.8 is announced, and it seems a particularly interesting driver has been added — the Surface 3 touchscreen controller. “This seems to be building up to be one of the bigger releases lately, but let’s see how it all ends up. The merge window has been fairly normal, although the patch itself looks somewhat unusual: over 20 percent of the patch is documentation updates, due to conversion of the drm and media documentation from docbook to the Sphinx doc format. There are other doc updates, but that’s the big bulk of it, ” says Linus Torvalds, Linux creator. Will Microsoft’s lower-priced (starting at $499) hybrid computer become the ultimate mobile Linux machine? Read more of this story at Slashdot.

Follow this link:
Linux Kernel 4.8 Adds Microsoft Surface 3 Support

Nigerian Scammers Infect Themselves With Own Malware, Reveal New Fraud Scheme

“A pair of security researchers recently uncovered a Nigerian scammer ring that they say operates a new kind of attack…after a few of its members accidentally infected themselves with their own malware, ” reports IEEE Spectrum. “Over the past several months, they’ve watched from a virtual front row seat as members used this technique to steal hundreds of thousands of dollars from small and medium-sized businesses worldwide.” Wave723 writes: Nigerian scammers are becoming more sophisticated, moving on from former ‘spoofing’ attacks in which they impersonated a CEO’s email from an external account. Now, they’ve begun to infiltrate employee email accounts to monitor financial transactions and slip in their own routing and account info…The researchers estimate this particular ring of criminals earns about US $3 million from the scheme. After they infected their own system, the scammers’ malware uploaded screenshots and all of their keystrokes to an open web database, including their training sessions for future scammers and the re-routing of a $400, 000 payment. Yet the scammers actually “appear to be ‘family men’ in their late 20s to 40s who are well-respected, church-going figures in their communities, ” according to the article. SecureWorks malware researcher Joe Stewart says the scammers are “increasing the economic potential of the region they’re living in by doing this, and I think they feel somewhat of a duty to do this.” Read more of this story at Slashdot.

More:
Nigerian Scammers Infect Themselves With Own Malware, Reveal New Fraud Scheme

New Attack Steals SSNs, E-mail Addresses, and More From HTTPS Pages

Security researchers at KU Leuven have discovered an attack technique, dubbed HEIST (HTTP Encrypted Information can be Stolen Through TCP-Windows), which can exploit an encrypted website using only a JavaScript file hidden in a maliciously crafted ad or page. ArsTechnica reports: Once attackers know the size of an encrypted response, they are free to use one of two previously devised exploits to ferret out the plaintext contained inside it. Both the BREACH and the CRIME exploits are able to decrypt payloads by manipulating the file compression that sites use to make pages load more quickly. HEIST will be demonstrated for the first time on Wednesday at the Black Hat security conference in Las Vegas. “HEIST makes a number of attacks much easier to execute, ” Tom Van Goethem, one of the researchers who devised the technique, told Ars. “Before, the attacker needed to be in a Man-in-the-Middle position to perform attacks such as CRIME and BREACH. Now, by simply visiting a website owned by a malicious party, you are placing your online security at risk.” Using HEIST in combination with BREACH allows attackers to pluck out and decrypt e-mail addresses, social security numbers, and other small pieces of data included in an encrypted response. BREACH achieves this feat by including intelligent guesses — say, @gmail.com, in the case of an e-mail address — in an HTTPS request that gets echoed in the response. Because the compression used by just about every website works by eliminating repetitions of text strings, correct guesses result in no appreciable increase in data size while incorrect guesses cause the response to grow larger. Read more of this story at Slashdot.

See the article here:
New Attack Steals SSNs, E-mail Addresses, and More From HTTPS Pages

Bitcoin Exchange Bitfinex Says It Was Hacked, Roughly $60M Stolen

An anonymous reader quotes a report from Reuters: Hong Kong-based digital currency exchange Bitfinex said late on Tuesday it has suspended trading on its exchange after it discovered a security breach, according to a company statement on its website. The company said it has also suspended deposits and withdrawals of digital currencies from the exchange. “We are investigating the breach to determine what happened, but we know that some of our users have had their bitcoins stolen, ” the company said. “We are undertaking a review to determine which users have been affected by the breach. While we conduct this initial investigation and secure our environment, bitfinex.com will be taken down and the maintenance page will be left up.” The company said it has reported the theft to law enforcement. It said it has not yet determined the value of digital currencies stolen from customer accounts. CoinDesk reports that the company confirmed roughly 120, 000 BTC (more than $60 million) has been stolen via social media. “In response, bitcoin prices fell to $560.16 by 19:30 UTC, $530 by 23:30 and $480 at press time, CoinDesk USD Bitcoin Price Index (BPI) data reveals, ” reports CoinDesk. “This price was roughly 20% lower than the day’s opening of $607.37 and 27% below the high of $658.28 reached on Saturday, July 30th, when the digital currency began pushing lower.” Read more of this story at Slashdot.

Read the original post:
Bitcoin Exchange Bitfinex Says It Was Hacked, Roughly $60M Stolen