Samsung, Apple, take top semi spots
Smart bin market isn’t rubbish
Turkish security expert kebabs VLC
A Turkish security expert found two zero-day vulnerabilities in library code used by the popular VLC media player around Christmas and is amazed they still have not been fixed.
Veysel Hatas found the data execution prevention (CVE-2014-9597) and write access (CVE-2014-9598) violation vulnerabilities in VLC and warned the outfit it could lead to arbitrary code execution.
“VLC Media Player contains a flaw that is triggered as user-supplied input is not properly sanitised when handling a specially crafted FLV” or M2V file”, Hatas wrote in his blog
“This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.”
Despite the fact that the flaw was discovered on Boxing day and VLC was about to release a new stable version on January 9, the flaw was never fixed.
The flaws lie within libavcodec, a core component of the video player and VLC is not the only one to use the library. MPlayer and other open-source software also use it.
It has been estimated that there are more than 1.5 billion downloads of the open saucy VLC thanks mostly to the fact it will play anything – including viruses apparently.
Ubuntu gets snappy with the internet of things
The Linux OS maker Canonical wants to extend its Ubuntu Snappy Linux technology to power the Internet of Things.
Ubuntu is best known as a popular Linux operating system for servers, cloud and desktops. Now Canonical is tweaking Ubuntu to power embedded devices and IoT.
The key to this is apparently the Snappy Ubuntu Core technology. Snappy Ubuntu Core was first announced on December 10, 2014, as a cut down version of Ubuntu.
Snappy was supposed to be a cloud technology but has been seen as a wizard thing to run embedded devices.
Mark Shuttleworth, founder of Ubuntu and Canonical, said that the use of Snappy could improve the security, reliability, and efficiency of update mechanisms and help to isolate apps from one another.
This fixes a problem with IoT that its operating systems are harder to upgrade – which makes them insecure.
Shuttleworth said that Snappy updates can be delivered as smaller, more efficient transactional updates. It also has an update rollback feature, which can enable an application to be reverted if the update is unsuccessful for some reason.
He said that Snappy has very efficient bandwidth usage, making it ideal for IoT embedded devices. With
Shuttleworth told eWeek that Canonical could deliver an update for something like a Heartbleed or Shellshock vulnerability, completely independently of the lawnmower control app that would come from the lawnmower company.
With IoT, anything and everything can be connected to the Internet, even potentially a lawnmower, and it is usually up to the vendor to provide patches for any security issues.
To help capitalize on the IoT opportunity, Canonical now has an entire Internet of things division within the company.
While it sounds grandiose that we have a whole Internet of things division, this is an extremely efficient repurposing of the technology we already have,” Shuttleworth said.
Samsung snubs Qualcomm
Samsung has ruled out using Qualcomm processors for the next version of the South Korean technology giant’s flagship Galaxy S smartphone.
Apparently the Qualcomm Snapdragon 810 chip had a nasty habit of overheating when Samsung came to test it. Samsung will use its own processors instead.
This would be a huge blow to Qualcomm which is the world’s largest maker of semiconductors used in phones, and has been supplying Samsung with chips that run the company’s best-selling handsets for ages.
Samsung is Qualcomm’s second-largest customer, providing about 12 percent of its sales, according to Bloomberg supply chain analysis.
It also gives Samsung a reason to boost its own processor-making division as it spends $15 billion on a new factory outside Seoul.
Samsung is expected to release the next Galaxy S as early as March, and it can’t dare to take the risk to use any of the chips in question for its most important model.
The company has been taking a kicking lately as smartphone sales slow. Releasing a phone into the market with a hot chip could sink it.
Qualcomm has not commented on the news shares fell on the news. In Europe they fell to 1.2 percent. Samsung shares rose 1.7 percent as news got out.
Qualcomm said in April its latest 808 and 810 processors will start appearing in phones at the beginning of this year and will feature more advanced computing, graphics and radio capabilities. Xiaomi and LG are among the manufacturers preparing to release models with the Snapdragon 810.
Dropbox buys CloudOn
Online document-sharing outfit Dropbox has acquired US-Israeli firm CloudOn.
CloudOn is a developer of tools to simplify creating and editing documents on mobile devices.
Financial details were not disclosed but money is believed to have changed hands.
CloudOn will become Dropbox’s first Israeli office and will focus on R&D. Dropbox plans to hire more engineers in Israel following the purchase.
Dropbox is waxing lyrical about what CloudOn brings to the company. It says that the CloudOn team will help build collaboration capabilities into Dropbox.
This means that Dropbox might be moving into end user content creation tools. So far it has Mailbox, a mobile email client, and Carousel, a mobile image viewing application. But nothing like compare to Google Docs or Microsoft’s mobile Office.
CloudOn customers have been told that the service will shut down in the next two months and that no new users will be accepted after today.
What is not clear is where this leaves Dropbox’s developing relationship with Microsoft.
In November, Dropbox teamed up with Microsoft to allow Office software users to manage and share files through Dropbox’s website and mobile app.
Microsoft has its own file sharing solution, OneDrive and did not really need Dropbox. However if Dropbox is heading into application land, one wonders why either side would find a relationship attractive.
Facebook cracking down on fake news
Facebook announced that it will update its news feed software to flag stories that might be false and limit their spread.
The social notworking site has been a key spreader of fake news, including celebrity deaths, fake science reports mostly because some seem to think that “satire” is the same as “made up news”.
Instead of looking at the comments on a given post, it has added an option for Facebook users to flag it as “a false news story” when they run across it in their feeds.
Facebook will also look at how often it has been deleted by the people who posted it. The theory is that a widely deleted post may be one that many users regretted posting because they realized it was bogus.
The site will not remove such stories from its feed. Instead, the company said it will reduce their distribution and add an annotation warning news feed readers that they may contain false information. A post that has been either widely deleted or flagged as false news by a large number of users will now come with a note like this when it appears in your feed:
“Many people on Facebook have reported that this story contains false information.”
It is not a big technology deal. Facebook’s software will not be analysing the actual content or substance of stories to suss out the fake ones. Instead, it thinks that relying on explicit feedback from human users—is far simpler and makes more sense. Humans are collectively better than bots at recognising bogus stories when we see them, although given the number of people who think that climate warming is untrue, vaccination gives kids autism, UFOs buzzed the International Space Station and President Obama is a Muslim we would not think that humans are doing that good a job.
To make matters worse so called “satirical” articles from sites like The Onion will not be flagged . The company found in its testing that these sorts of posts are not often flagged as false by users. Goodness knows what this will do to Fox News’ presence on Facebook.
This is not the first time that something like a hoax-flagging algorithm has been tried on Facebook. It had a “war on clickbait” which was based on the same ideas and it did not exactly end Upworthy’s reign of terror even when it still runs stories with intros like “you will never believe what happened next”.
UK open to security abuse
Microsoft to open Windows 10 kimono
European PC shipments rise
1.167 billion smartphones sold last year
Police seize Swiss druggie robot
A Swiss art project entitled “The Random Darknet Shopper” has been spending $100 in Bitcoins to buy random products off the Darknet.
The project used a Darknet-surfing robot and apparently managed to buy 10 ecstasy tablets and a bogus Hungarian passport scan.
The London-based Swiss artists !Mediengruppe Bitnik – Domagoj Smoljo and Carmen Weisskopf wrote on their blog that the robot’s artistic habits did not impress Swiss coppers.
After the exhibition in Switzerland closed, the public prosecutor’s office of St. Gallen seized and sealed their work with the purpose of “impeding an endangerment of third parties through the drugs exhibited by destroying them.”
The artists describe their medium as the use of hacking as an artistic strategy and say that they programmed The Random Darknet Shopper to answer the basic human questions like what does it mean for a society, when there are robots which act autonomously?
They are also curious to see who is liable, when a robot breaks the law on its own initiative.
Apparently the artists have discovered that it is them.
“We are the legal owner of the drugs – we are responsible for everything the bot does, as we executed the code. But our lawyer and the Swiss constitution says art in the public interest is allowed to be free,” they said.
Swiss prosecutors have yet to decide that point. But it does seem that the robot managed to have an interesting stash of illegal goods. This included a counterfeit pair of Diesel jeans, A Sprite stash can that you can hide drugs or cash in, a decoy letter, a baseball cap with a hidden, remote control, mini video camera, and a platinum Visa card, a carton of Chesterfield cigarettes from Moldavia and a master set of fire brigade keys.
Samsung considers split
Samsung is considering a stock split in a bid to keep its investors happy as the outfit experiences sliding profits.
Samsung head of investor relations Robert Yi told reporters the company had been considering a stock split for some time but it was too early to make a decision. A split would make Samsung shares easier to buy and could attract more retail investors.
The world’s top smartphone maker has launched a $2 billion share buy-back program and promised to increase its 2014 year-end dividend by up to 50 percent in a bid to lift its share price and placate investors.
However, Samsung shares are well below last year’s peak of $1,380 mostly because of a string of quarterly profit declines. In fact, the only thing that stopped them sinking lower was the buyback and a planned dividend increase.
Apple saw its shares end up 37.7 percent last year, thanks in part to a seven-for-one split, so it might be another case where Samsung is emulating Jobs’ Mob.
Apple’s Siri in data heist
Apple’s voice activated personal assistant Siri is being used to steal sensitive information from iOS based smartphones.
Luca Caviglione of the National Research Council of Italy and Wojciech Mazurczy of the Warsaw University of Technology warn that “malicious actors” could use Siri for stealthy data exfiltration by using a method that’s based on steganography, the practice of hiding information.
Clearly the malicious actors are hacked off that people have been stealing their pictures from the iCloud and posting them online and have taken Siri hostage.
iOS malware is also increasingly common, as the popularity of the iPhone is matched by the company’s misplaced belief in its own security vulnerability.
Mazurczy and Caviglione have demonstrated that iOS malware could become difficult to detect.
When users talk to Siri, their voice is processed with the Speex Codec, and the data is transmitted to Apple’s servers where the voice input is translated to text.
Using an attack method called iStegSiri, the “shape” of this traffic embeds sensitive data from the device. This covert channel could be used to send credit card numbers, Apple IDs, passwords, and other sensitive information from the phone to the criminals.
First, a secret message is converted into an audio sequence based on voice and silence alternation. Then, the sound pattern is provided to Siri as input through the internal microphone. Finally, the recipient of the secret message inspects the traffic going to Apple’s servers and extracts the information based on a decoding scheme..
In their experiments, Mazurczy and Caviglione managed to use this method to exfiltrate data at a rate of 0.5 bytes per second. At this speed, it would take roughly 2 minutes to send a 16-digit payment card number to the attacker.
It only works on jail broken devices and attackers somehow need to be able to intercept the modified Siri traffic. However, the researchers highlighted that the purpose of iStegSiri is to help the security community with the detection of malware on the iOS platform.
The researchers told IEEE Spectrum that they have not made specific details on iStegSiri public to prevent cybercriminals from using their work. We guess that Apple have not modified anything in the iOS to stop it happening if someone works it out.