Gregarius » BetaNews.Com » janvier 30, 2016

BetaNews.Com (8 non lus)

Stop using Microsoft Edge's InPrivate mode if you value your privacy

Publié: janvier 30, 2016, 8:28pm CET par Mark Wilson

It's possible that you reached this article purely by chance, or you may have Googled 'how to change the default search engine in Microsoft Edge'. However you got here, the fact that you're reading this indicates that you're either interested in Windows 10's Edge, or actively use it -- and this means there's something you need to know.

If you fall into the latter camp and use Edge's InPrivate mode to cover your online tracks, you might want to think about changing your web browser. Edge has already got some stick for its lack of extension support -- "it's coming, it's coming!" Yeah, whatever... so's Christmas -- but now it turns out that InPrivate mode is a privacy nightmare. It is possible to peak behind the curtain and see which sites have been visited when using a browsing mode that should mask this.

There are similar features found in other browser. Chrome has Incognito mode, Safari has Private Browsing, Firefox has... actually, Firefox has Private Browsing too. Whatever the name, what these browsing modes all have in common is that once the browser is closed, there is no record of which sites have been visited. That's not to say that ISPs and law enforcement agencies wouldn’t be able to determine the browsing history, but from a local point of view it is as though no browsing has taken place.

But Edge is different.

Somewhat counterintuitively, Edge actually records browsing history in InPrivate mode. More than this, by examining the WebCache file it is a relatively simple task for someone to reconstruct full browsing history, regardless of whether surfing was performed in regular or InPrivate mode.

Over on Forensic Focus, researcher Ashish Singh warns:

The forensic examination of most web browsers has proven that they don't have a provision for storing the details of privately browsed web sessions. Private browsing is provided for a purpose, i.e. privately browsing the web, which is being delivered.

However, in the case of Microsoft Edge even the private browsing isn't as private as it seems. Previous investigations of the browser have resulted in revealing that websites visited in private mode are also stored in the browser’s WebCache file.

NOTE: The Container_n table stores web history. There a field named 'Flag' will be available. A website visited in the private mode will have a flag value as '8'. Generally the purpose of storing this information is to retrieve crashed private sessions.

\Users\user_name\AppData\Local\Microsoft\Windows\WebCache

Therefore any skilled investigator can easily spot the difference and get concrete evidence against a person’s wrongdoings. Plenty of artifacts are maintained by the browser, which makes examination quite easy. However, there are stages where evidence is not so easy to find. The not-so-private browsing featured by Edge makes its very purpose seem to fail.

Microsoft is aware of the problem, and says:

We recently became aware of a report that claims InPrivate tabs are not working as designed, and we are committed to resolving this as quickly as possible.

As is often the case, there is no indication of quite when this might be fixed, but it will be fixed. At some point. But you can't help but ask how such a fundamental aspect of private browsing could be so fantastically borked. It beggars belief.

Photo credit: T.Dallas / Shutterstock
Microsoft is still working to fix Surface Book and Surface Pro 4 power management problems

Publié: janvier 30, 2016, 7:15pm CET par Mark Wilson

Surface devices have been in the news for all the wrong reasons recently. As well as false accusations of Surface tablet causing problems at the NFL playoffs, Microsoft has also recalled Surface Pro power cords because of an overheating issue. Some problems are fixed with a little good PR, but other require software fixes.

Just a couple of days ago, Microsoft released a firmware update for Surface Pro 4 and Surface Book. While this addresses problems with Bluetooth performance, battery charging, and wireless issues, it does nothing to resolve the power management and battery drain issues many users are experiencing. Microsoft says a fix for this is still in the works.

Surface Book and Surface Pro 4 owners have reported issues with power management when placed in standby mode. It's a problem that have been known about for some months now, and it sees massive battery drain when the devices should really be using minimal power. But if you're hoping for a quick fix, you might have a wait on your hands.

Writing on its support forums, Microsoft said:

Yesterday our engineering team published some updates for Surface Book and Surface Pro 4. These updates offer refinements to improve battery charging and thermal tuning, wireless and Bluetooth performance, and to the detach-reattach experience on Surface Book. We know some of you are still experiencing issues, including issues related to power management, and we are working to address those as quickly as possible. We’ll publish additional updates as soon as they are ready.

At the moment there is no indication of just when the problem might be addressed, but in the meantime, users continue to experience battery drain of up to 12 percent per hour even when their devices are not in use.
LG G3 'Snap' vulnerability leaves owners at risk of data theft

Publié: janvier 30, 2016, 4:32pm CET par Mark Wilson
Security researchers have discovered a vulnerability in LG G3 smartphones which could be exploited to run arbitrary JavaScript to steal data. The issue has been named Snap, and was discovered by Israeli security firms BugSec and Cynet.

What is particularly concerning about Snap is that it affects the Smart Notice which is installed on all LG G3s by default. By embedding malicious script in a contact, it is possible to use WebView to run server side code via JavaScript. If exploited, the vulnerability could be used to gather information from SD cards, steal data from the likes of WhatsApp, and steal private photos.

Researchers identified a number of possible attack vectors, including asking a victim to scan a QR code, or sending a fake contact via WhatsApp or MMS. Liran Segal and Shachar Korot, who discovered the vulnerability, say they contacted LG and the company responded quickly by updating Smart Notice with a patch. The onus is on G3 owners to install the update.

In a blog post, Cynet says:
The root cause for the security problem is the fact that Smart Notice does not validate the data presented to the users. Data can be taken from the phone contacts and manipulated. The attack can take place in several ways due to functionality issues of the Smart Notice application. The application pops notifications (named 'cards') in each of these scenarios:
- Favorite contact notification – Recommends you keep in touch with favorite contacts.
- New contact suggestion – Suggests saving a caller number.
- Callback reminder – Reminder to callback a contact after declining the call.
- Birthday notification – Reminder about contact birthday.
- Memo reminder – Provides notifications about user memos.
The video below from BugSec Group shows how the vulnerability can be exploited:
Adobe pushes out betas for version 21 of Flash and Air

Publié: janvier 30, 2016, 4:22pm CET par Alan Buckingham

Lots of things are said about Flash, and most of them aren't good. The Adobe app has proven to be a security nightmare and constant updates do little to alleviate the problems. Now a new version is on its way and hoping to fix things.

New versions of Flash 21 and Air 21 are in the works, currently these products are codenamed "Sutter". Don't expect any major changes, the company points out it's just incremental advances.

"This beta release includes new features as well as enhancements and bug fixes related to security, stability, performance, and device compatibility for Flash Player 21 and AIR 21", the software maker announces.

Both are being released by Adobe Labs, meaning they are a bit experimental, so you may experience some issues in using them. Likely you won't but that caveat needs to be pointed out, as it does with all beta software.

You can grab the updates from the following links:

Download Adobe AIR 21 beta

Download Flash Player 21 beta

Adobe concludes that "As always, we appreciate all feedback. We encourage you to post in our beta forums or create bug reports or feature requests on our public bug database".
Why did Google give $6,006.13 to MBA candidate Sanmay Ved?

Publié: janvier 30, 2016, 3:41pm CET par Mark Wilson

Google's security bounty programs can be quite lucrative for those who discover problems, and the company has just published a report looking back at the security landscape in 2015. Entitled Google Security Rewards - 2015 Year in Review, the report reveals the financial rewards that have been paid out in the last 12 months.

In all, Google has paid out more than $2 million to more than 300 people, but Sanmay Ved is probably one of the more interesting reward recipients. He's the guy who -- very briefly -- managed to buy Google.com before having it taken off his hands. Google offered him a $6,006.13 reward, but there's a little more to the story.

If you're wondering about the slightly strange amount, Google explains that if you squint and use a little imagination, the figure spells out the word Google. Sanmay decided to donate his reward to charity, and when Google learned about this, the reward was doubled. While Sanmay may have been one of the more unusual reward recipients, Tomasz Bojarski got the crown for the most prolific, discovering no fewer than 70 bugs on Google.

2015 was the year that Android was added to the to the Security Reward program initiative resulting in payments of over $200,000 to researchers. Google shares a graphic that shows some of the highlights from 2015:

In 2015, Google's Vulnerability Research Grants was used to provide researchers with the funds they need to carry out their work. One example of how these funds were used includes research into a YouTube problem:

We’ve already seen positive results from this program; here’s one example. Kamil Histamullin a researcher from Kasan, Russia received a VRP grant early last year. Shortly thereafter, he found an issue in YouTube Creator Studio which would have enabled anyone to delete any video from YouTube by simply changing a parameter from the URL. After the issue was reported, our teams quickly fixed it and the researcher was rewarded $5,000 in addition to his initial research grant. Kamil detailed his findings on his personal blog in March.

Find out more about Google's reward programs over on the Google Security blog.

Photo Credit: tanuha2001 / Shutterstock.com
'Alexa, turn on kitchen lights': Setting up Cree bulbs with Amazon Echo and Wink hub

Publié: janvier 30, 2016, 12:20pm CET par Alan Buckingham

"Alexa, turn on the lights". This is a phrase echoed, apparently, by more people than I thought. Amazon's Echo is taking hold and seems especially popular with those interested in the home automation side of technology. Voice control can be both good and bad, though. It's great when it works, but embarrassing and frustrating when it doesn't.

Let's start with the bad, though really it's just the amusing. My Amazon Echo is in my living room, as is the TV. Words emitting from my surround sound system can sometimes have hilarious results -- music suddenly beginning to play, Alexa telling me she doesn't understand the question, and if an ad for Echo comes on then things go nuts.

With all of that said, the device is very good. It makes a great speaker -- it plays music while I work, it gives me sports and weather updates as well.

But one area Amazon really seems to want to move into is home automation -- the smart home, the Internet of Things, whatever you wish to call it. Companies are increasingly coming on board to work with Alexa and allow voice control of all sorts of products. All it takes is a hub and several are already operational with it.

A while back I wrote about setting up the Wink hub with Echo and then using it to control my living room lights which I outfitted with GE Link bulbs. Now I am once again using the Wink hub but this time to control Cree bulbs in my kitchen. The process is pretty much the same, but we'll walk through it once more, as both apps have updated since the last time, so a bit is different.

So here are the steps. It's fairly simple, but not necessarily intuitive.

1: Install the bulbs and connect hub.

2: Install the Wink app on your phone or tablet -- Android or iPhone (sorry Windows Phone)

3: Open the app and click menu at the top left.

4: You need to let the app discover and add the lights and also name them -- naming is important. The app will walk you through the steps. Be sure the lights are turned off when you start.

5: Create a group and add the lights to it, then give the group a name.

6: Test this by turning off one bulb at a time and also the entire group at once. Just tap each bulb and then switch to the group view and tap its name ("Kitchen" in this case).

7: Open the Alexa app on your device.

8: Click Menu > Settings > Connected Home.

9: Click "Discover new products". The app should find your bulbs in 15-20 seconds (the Wink app can take much longer).

10: Click "Create group", name it and check the boxes next to your bulbs then save it.

11: Now test Alexa -- "Alexa, turn on/off kitchen".

Things should be all up and running for you now. If you have a problem then verify the steps. At worst you can always call Wink or Amazon, both have excellent customer service.
Act now! You only have this weekend to save your free OneDrive storage before Microsoft takes it away for good

Publié: janvier 30, 2016, 9:48am CET par Wayne Williams

Free online storage space is something many of us really appreciate. Quotas are usually so generous that’s there’s rarely a need to spend money on a paid subscription.

However, Microsoft recently announced plans to cut back on the amount of free storage offered to OneDrive users. As a recap, the base storage will drop from 15GB to 5GB, the 15 GB camera roll storage bonus is being discontinued, Office 365 Home, Personal, or University users will no longer get unlimited storage, and some paid tiers are going away also.

After an outcry from disappointed OneDrive users, Microsoft backtracked and permitted users with 15GB of OneDrive space to keep their base storage quota and camera roll bonus, even after the changes roll out. There is a catch though.

This is an opt-in offer with a time limit and you need to act before the end of January 31 to secure your free storage. Delay, and it will be gone for good.

The good news is saving your space is incredibly easy. All you have to do is go here and click the "Keep your free storage" button. That’s it.

So what are you waiting for? Go do it now before you forget and it's too late.

Photo credit: sarahdesign / Shutterstock
Facebook bans private gun sales -- no, that doesn't violate your 2nd Amendment rights

Publié: janvier 30, 2016, 2:51am CET par Brian Fagioli

While many people view Second Amendment defenders as gun nuts, the truth is, that isn't always the case. A good example? Me. While I am a life member of the NRA, firearms don't really thrill me. No, I get my jollies from computers and technology. My interest in Second Amendment protection is mostly constitutional -- I don't want to see any of my fellow Americans' rights get trampled.

Today, Facebook announces that it is banning private gun sales on its site (and Instagram). Of course, some folks will see this as an attack on the Second Amendment, and maybe even the First Amendment. The truth of the matter is, neither your freedom of speech nor your right to bear arms are impacted by Facebook's decision. Why? Because the social network is not a public or government place. Facebook has the right to determine its own policies.

I reached out to Facebook for more information. A spokesperson for the company told me the following.

Today we are updating our policies for managing regulated goods to prohibit people from using Facebook to offer and coordinate private sales of firearms. This policy already prohibits people from offering marijuana, pharmaceuticals, and illegal drugs for sale.

The updated policy aligns more closely with our policies around commerce and advertising, which place similar restrictions on advertisements of regulated goods including pharmaceuticals, illegal drugs, and firearms.

This policy update focuses on private or 'peer-to-peer' sales of weapons, not weapons that are being sold in stores or off Facebook through online, licensed retailers. Licensed firearm retailers will still be able to post about their goods and services on Facebook while completing sales transactions off Facebook.

We have systems in place to review and remove content that violates our terms of service and advertising that is false, deceptive, or misleading.

There you go folks, only peer-to-peer sales are impacted by this decision. This means licensed businesses can continue to leverage the social network to advertise firearms. Heck, individuals can still post pictures of themselves with guns, discuss guns, and even post videos of themselves at a shooting range.

Quite frankly, this is a smart and responsible move on Facebook's part. There has been a lot of gun violence lately, and private sales on the site could elude police or other investigators. Will the private sales ban stop all gun violence? No. But at least it means one less way for bad guys to purchase guns under the radar.

Job well done, Facebook.

Photo credit: JPL Designs / Shutterstock