#after over a week of bootlooping

[edenorisshitposting]

my computer is working again yay

[32-character-limit-in-urls]

Week 5 roundup: new guidelines, remote unlocking, forced surveillance, and resetting other people’s passwords

Welcome to the third edition of my roundup blog posts. If you’re reading this, it means Tumblr’s text editor didn’t explode this time.

Germany set to detail security measures that must be present in web browsers they are deemed “secure”

Image credit: Gizmodo

Modern web browsers are very capable and thus see widespread use. This means they should be secure against any attacker in the everchanging internet landscape. Because the scope of a possible attack is so wide nowadays, it is difficult to define what “secure” means in the context of a web browser. Regardless, Germany is set to detail guidelines that define what a browser must have in order to be deemed “secure”.

Germany’s Federal Office for Information Security, or Bundesamt für Sicherheit in der Informationstechnik (BSI), first introduced these guidelines in 2017. They have published a new draft document with new guidelines. The notable guidelines include:

Mandatory support for TLS

Mandatory support for a list of trusted certificates, including extended validation (EV) certificates. These certificates must be verified against a Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP)

Indication to the user via iconography or colour to show the encryption status of network communications

Mandatory support for HTTP Strict Transport Security (HSTS) (RFC 6797), Same Origin Policy (SOP), Content Security Policy (CSP) 2.0, and  Sub-resource integrity (SRI)

Mandatory signed and verifiable automatic updates of the browser and its installed extensions or plugins

The browser’s password manager, if it has one, must store user-deletable, encrypted passwords. Access to the password manager is only granted to the user after they have entered a master password

Browser cookies and history must be user-deletable

Giving organisations the option to disable or prevent the sending of browser telemetry or usage statistics, the ability to have locally locally-defined site blocklists, and the ability to regulate the browser addons or extensions installed

Mandatory inclusion of mechanism to detect harmful content or URLs

Accessible options to toggle plugins, extensions or Javascript

The browser must be executable with minimal permissions from the operating system

Mandatory sandboxing or isolation of webpages and browser components. Components may communicate with other components via an interface. Resources of the components must not be directly accessible

Browsers must be programmed in a language that support stack and heap memory protections

The browser’s vendor must move to a new browser if a security flaw is not fixed within 21 days of public disclosure

The draft document is currently going through public debate in Germany. Once this is complete, the BSI will publish the finalised document with all the guidelines.

Source: ZDNet

Zipato smart hubs had a vulnerability that allowed for the easy unlocking of connected smart locks

Image credit: TechCrunch

Smart homes with smart things in them are thought to be more secure than their tradtional counterparts. However this is not the case as some security researchers discover a security flaw with Zipato smart hubs that made it possible to remotely unlock a connected smart lock. I wrote a separate blog post about this in more detail earlier in the week.

Source: TechCrunch

Tourists in China’s Xinjiang region are forced to install data-collecting malware on their smartphones

Image credit: The Guardian

China already controls and sees what its citizens can see and say both on the network level and on the personal device level. It is more difficult to exert this control to personal devices from foreign tourists. Authorities in China’s Xinjiang region are flexing their powers to access these foreign devices.

A joint investigation between VICE, The New York Times, The Guardian,  Süddeutsche Zeitung and German broadcaster NDR has revealed the extent of the surveillance on foreign tourists being carried out by Xinjiang authorities.

Border authorities stop tourists and confiscate their phones. The authorities then install a pre-built malware app referred to as BXAQ or 蜂采 (Fēng cǎi). BXAQ collects data on the phone owner’s emails, text messages, contacts. The app also seems to collect data on the phone’s hardware specifications. Any data collected by the app is uploaded to a server.

The Xinjiang region of China is home to a large Muslim population. Chinese authorities are undergoing a mass surveillance program of the region and its people. BXAQ seems to be also searching and flagging any data or information related to Islam. Some of these include an al-Qaida produced magazine and information on the Islamic month of Ramadan. Other seemingly unrelated things BXAQ flags are information on the Dalai Lama and a Japanese metal band.

For iOS devices, the device is plugged into a reader that performs the same scanning procedures as BXAQ. Android devices support  third-party app sideloading so the BXAQ app is installed directly on the device and is uninstalled afterwards. In some reare cases, authorities did not uninstall BXAQ before return the phone to its owner. The APK file for the Android BXAQ app was obtained by VICE and uploaded to their GitHub account.

It is not clear where the collected data is sent to or how long it is stored before being deleted. The joint investigation also notes there is no evidence of surveillance of tourists after they have their phones returned to them.

Source: VICE, The New York TImes, The Guardian

7-Eleven Japan discontinues new mobile payment app within days after launch

Image credit: Google Play

7-Eleven Japan recently launched a new mobile payment app. Usage of the app was discontinued within days because it allowed users to reset the passwords of other user accounts. I wrote a separate blog post about this in more detail.

Source: Android Police, ZDNet

In other news

Google releases the monthly Android security patch for July. Some critical vulnerabilities with the kernel, WLAN host and driver, and audio were fixed, with Android version 7.0 Nougat and newer affected.

Dating app fined for misleading users about privacy and leaking their nudes. The app leaked user’s photos for a year and did not make any changes despite being notified of the leak by several news sites when first discovered. The photos were found on an unprotected server.

Decade-old “Heaven’s Gate” technique is still being incorporated into modern malware. Heaven’s Gate works to allow 32-bit applications running on 64-bit machines to execute 64-bit code. 64-bit operating systems have a subsystem to run 32-bit applications and by escaping this, the malware application was able to evade antivirus detection. This vulnerability is patched in modern OSes like Windows 10, but Heaven’s Gate malware applications still target legacy OSes.

U.S. Customs and Border Protection suspends a subcontractor after collected information was transferred to its network that was attacked. Photos of travellers and car registration plates were transferred. Attackers stole government agency contracts, budget spreadsheets and slideshow presentations.

MacOS malware masquerading as an installer for Adobe Flash is appearing in Google search results. The malware installs mallicious applications and browser extensions.

Phishing site mimics the site used to obtain the Instagram “verified” checkmark. The site was discovered by some security researchers.

Google security researcher discovers an iMessage vulnerability that soft-bricks iPhones. The vulnerability caused the Springboard, the launcher app that handled the homescreen on iPhones, to crash and launch itself infinitely mimicing the behaviour of a bootloop. All solutions to recover from this require the affected user to wipe their device.

OpenID Foundation says “Sign In with Apple” is not OpenID complient and insecure. The new service announced by Apple at WWDC 2019 is built on top of the OpenID connect platform but is not compliant with all the standards set by the foundation.

Attack steals money from banks in Bangladesh, India, Sri Lanka and Kyrgyzstan. One affected bank in Bangladesh had over $3m USD stolen.

UK forensics firm paid ransom to attackers. The ransomware caused police to suspend all operations with the firm.

--

Hero image credit: Getty Images via The New York Times

[techbotic]

Irate customers sue Google over Pixel’s allegedly awful microphones

Enlarge / The Google Pixel and Pixel XL (credit: Ron Amadeo)

The same San Francisco law firm that recently settled arbitration claims against LG over the "bootloop" issue has now filed a new proposed class-action lawsuit against Google. This time, the firm is alleging manufacturing defects in the microphone on Pixel and Pixel XL handsets.

The firm's clients—Patricia Weeks of Florida and Waleed Anbar of California—say that they both purchased Pixel phones in 2016. However, months after their purchases, they both said that they experienced a defective microphone. The case, Weeks v. Google, was filed Tuesday in federal court in San Jose, California.

When they approached Google's customer service, they were told that Google would not refund them or offer a replacement.

Read 5 remaining paragraphs | Comments

Irate customers sue Google over Pixel’s allegedly awful microphones published first on https://medium.com/@CPUCHamp

[the-phoenix-does-exist]

Wow. Long time no post.

So, I’ve been gone for awhile. Basically what happened was I had a really crappy phone that didn’t have enough space for anything, it could only hold maybe 25 pictures. So, for over a year, I used an old for my social media and photos. But that was an LG. And it got the bootloop about a year ago and my actual phone couldn’t handle anything so I had no choice but to vanish for awhile. And my laptop is a POS so that wouldn’t have worked, either.

But, now I have a new phone and now I’m back!

A lot has changed. Obviously, I changed my username and my theme. Instead of being depressed and suicidal, I now want my blog to be more encouraging. And here’s why.

Back in June, I almost died. My gallbladder decided it wanted to become septic and try to kill me, so I had to have emergency surgery. The surgeon told me afterwards that if I had waited any longer to go in, I wouldn’t be here. And I felt nothing. So, my loved ones started to try and convince me to seek help.

I went to a small clinic in the state I live in. I got meds and they made me worse so I ended up in the psych ward after attempting to drive my car into a wall. I got different medication. Then a different one and, a week after being on that one, I was placed on the highest dose. That numbed me out to everything, so I was lowered down .5 mg and placed on an additional medication.

Now, I’m functioning better than I ever have. I’m growing and maturing and learning about myself, the people around me, and I’m enjoying more moments in life. I don’t actively want to die anymore.

I know not a lot of people look at my blog, but I’m hoping with putting more positive content and encouraging posts, that maybe someday I’ll be able to reach someone who really needs what I’m posting.

I chose the new username because those who struggle with mental illness and addiction are a Phoenix. They struggle and struggle and struggle through everyday and each new day, they’re reborn. Each new day is a new chance and a new opportunity. At least, that’s what I believe.

[buytabletsonline]

(adsbygoogle = window.adsbygoogle || []).push({});

Seeing consumers launch class action lawsuits against giant companies is a relatively common thing, and today, Google is in the crosshairs. Google has been hit with a class action complaint alleging that it didn’t honor warranties for the original Pixel and Pixel XL when it became clear that the phones suffered from microphone defects. The complaint was filed by Girard Gibbs LLP in San Jose, the same law firm that recently handled the class action lawsuit surrounding the bootloop issue some LG phones experienced.

Girard Gibbs filed the complaint on behalf of two plaintiffs, Patricia Weeks and Waleed Anbar, along with “all others similarly situated.” Ars Technica made the complaint publicly accessible over on DocumentCloud, and notes that both of these plaintiffs purchased Pixel devices in 2016, only to encounter defective microphones a few months later.

When they brought the problem to Google’s attention, the company didn’t offer to replace or refund the devices, which this complaint alleges was a breach of Google’s own warranty. In fairness, Anbar wasn’t within his one-year warranty period when he reported the problem to Google, having purchased the phone in December 2016 and reporting the issue in January of this year. Weeks still was, however, as she reported the issue just three months after she purchased the phone.

It’s worth pointing out that these weren’t exactly isolated cases. A sizable number of Pixel and Pixel XL users began to report microphone issues after both phones launched in October 2016. In fact, a lengthy thread over on the Pixel support forums has more than 800 replies about this very problem, so it seems that it’s at least fairly widespread.

Google, for its part, won’t comment on pending litigation against it, but in a statement to Ars, it directs anyone who is experiencing issues and owns a device that’s out-of-warranty to check out its help center to find out what they can do. We’ll see how this one turns out for Google, but if it was refusing warranty replacements for defective phones, this may end up being a cut and dry case. Stay tuned.

(adsbygoogle = window.adsbygoogle || []).push({}); http://ift.tt/2BmHz34 February 10, 2018 at 12:33AM