Gregarius » BetaNews.Com » février 11, 2016

BetaNews.Com (13 non lus)

Changing the date could permanently brick your iPhone

Publié: février 11, 2016, 9:22pm CET par Wayne Williams

There have been a few serious iPhone issues discovered recently. Some phones got bricked by the iOS 9 Slide to Upgrade bug, there was a website that instantly crashed browsers and rebooted iPhones, and -- most recently -- Error 53 bricked devices repaired by non-Apple technicians.

Now a new iPhone-bricking bug has reportedly been discovered. And I say reportedly, because I’m certainly not about to try it.

According to a post on Reddit (and backed up by some reports in China), setting your device back to a particular date and time will brick it.

Now here comes the warning. It should go without saying, but trying this yourself will in all likelihood brick your device, and we wouldn’t want that. If you really want to do it, go ahead, but we really, really would advise against it. Obviously.

The bug, which only affects 64-bit Apple devices, including iPhones, iPads and iPod touches, rears its head when you set the date to January 1, 1970 (aka the Unix epoch). You do this by going to Settings > General > Date & Time and toggling off the option to set the date and time automatically. Scroll back to 2000, go back into Date & Time settings and repeat the process until you hit 1970.

Once you’re at the date, reboot your iPhone and it will (probably) die a sad and lonely death.

According to the reports, neither putting the phone into DFU mode nor restoring it from a backup fixes the problem. Although disconnecting the battery and reconnecting it, or letting it drain down fully might (again, we haven’t tested it).

Some people have reported that they’ve tried this and their phones have emerged unscathed.

A Reddit user speculates this might be down to time zones. He says:

For those who got away with trying this and it not bricking your device, there's a reason why -- time zones.

In some time zones, setting the date to 1 Jan 1970 will set the internal clock to a number less than zero, as the time is stored in GMT (as the number of seconds since midnight on that date) and then the offset is applied before display. In other time zones, setting the clock will result in a positive time value. Best guess is that this is triggered by having the time value less than zero.

Obviously this isn’t really a bug to worry about -- if you don’t ever set your device back to that date then nothing will happen. But maybe make sure you have a passcode or Touch ID set on your phone, to prevent malicious pranksters testing out this trick while your back is turned.

Photo Credit: iQoncept/Shutterstock
Gmail now warns you if your emails are not TLS encrypted

Publié: février 11, 2016, 8:31pm CET par Mark Wilson

To celebrate Safer Internet Day the other day, Google gave away an extra 2GB of cloud storage to anyone who completed a simple security audit of their account. At the same time the company also introduced a couple of important security enhancements to Gmail.

The first change sees the appearance of a simple indicator that makes it clear when an email is received through, or is about to be sent through, a service that doesn’t support TLS encryption. A broken padlock icon indicates that TLS encryption is not available, serving as a warning that there is the potential for the email in question to be dangerous or for the message to be intercepted.

Google points out that in order for TLS (Transport Layer Security) to be effective, it is important that it is supported by both the sender and the recipient of emails. If either party fails to meet this requirement, this is when the broken padlock indicator makes an appearance.

The second security feature makes it easier to tell when an email address has been authenticated. While you would normally expect to see an avatar for people you already have in your address book, non-authenticated senders have previously simply had a blank profile image. The latest change sees non-authenticated senders highlighted with a red question mark avatar which should be easier to notice.

Google says:

Not all affected email will necessarily be dangerous. But we encourage you to be extra careful about replying to, or clicking on links in messages that you’re not sure about. And with these updates, you’ll have the tools to make these kinds of decisions.

Photo credit: Butterfly Hunter / Shutterstock
Mac tool vulnerability exposes lots of apps to man-in-the-middle attacks

Publié: février 11, 2016, 8:29pm CET par Alasdair Gilchrist
A security specialist has discovered a flaw in Sparkle, a third-party framework that Mac apps use to receive updates, which makes a man in the middle attack possible when unencrypted HTTP connections are used.

If the attacker has the ability to intercept the unencrypted data stream for example on a public Wi-Fi hotspot they could possibly inject malicious code.

The number of apps affected is unknown, but researchers believe there to be a significant number. Some of the known vulnerable apps are; Camtasia 2 v2.10.4, DuetDisplay v1.5.2.4, uTorrent v1.8.7, and Sketch v3.5.1. as well as Hopper reverse engineering tool and DXO Optics Pro, amongst many others.

However, not all apps that use Sparkle are susceptible, only ones that use HTTP instead of HTTPS and use a vulnerable version of Sparkle are at risk. Sparkle has issued an update, however the security specialist, Radek, who originally discovered the flaws warns in an email, that it is not a trivial process to apply it.

This process requires [a developer] to:
- Download the newest version of Sparkle Updater
- Check if new version of Sparkle is compatible with the app
- Create some test cases, verify update and so on
- Address this vulnerability and publish new version of the app
Now, this is the moment when people can check for an update and replace this particular app version on their Macs with the newest one.

It all depends on the complexity of an application, its size and maintainers. That’s the reason why some developers don’t want to update or can’t update Sparkle in their applications (quickly enough).

Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.

Photo credit: wk1003mike / Shutterstock
SourceForge pledges to clean up its downloader act

Publié: février 11, 2016, 6:11pm CET par Alan Buckingham

Likely just about everyone has installed software from SourceForge at some point in their computing history. In 2013, the software repository enabled a feature called DevShare which developers could opt-in to. This wrapped developer software in SourceForge’s own installer, which also, unfortunately, came with bundled junk -- something many users might breeze right past during an installation.

But last month Sourceforge, along with Slashdot, was sold to BIZX and some changes are going to take place under the new ownership, and that means no more DevShare.

SourceForge president Logan Abbott says "We want to restore our reputation as a trusted home for open source software, and this was a clear first step towards that. We’re more interested in doing the right thing than making extra short-term profit".

The company now wants to focus on developers and visitors, creating a better experience. Logan goes on to say "Eliminating the DevShare program was just the first step of many more to come. Plans for the near future include full https support for both SourceForge and Slashdot, and a lot more changes we think developers and end-users will embrace".

While it's a good start, the company may find that it will take time to regain the trust of users. One too many bad experiences can do that.

Photo Credit: Gajus/Shutterstock
Microsoft is slowly conquering Android

Publié: février 11, 2016, 5:38pm CET par Mihăiță Bamburic

Microsoft may not have a strong presence in the smartphone market as a vendor, but the software giant is trying to make a splash in a different way, by partnering with other players to make its mobile apps available on as many devices as possible. And it stands a very good chance of making serious inroads.

Microsoft has so far teamed up with 74 companies, in 25 countries, to ship its apps on their Android smartphones and tablets. The latest major player to partner with Microsoft is Acer, which will preload some of the software giant's most-prominent Android apps.

The focus is on cloud services and Office, as Acer's customers can expect to find Excel, PowerPoint, OneDrive, OneNote, Outlook, Skype and Word on their new Android devices. Microsoft says that these apps are already preloaded on smartphones and tablets like LG G Pad 2 and Samsung Galaxy S6, and that "specific offerings may vary by device".

This agreement will bear fruits starting in the second half of the year, but it will not impact every single new Android device in Acer's portfolio. There is no word on what sort of devices will have Microsoft's apps preloaded, but premium smartphones and tablets are likely targeted.

Microsoft does not say exactly what its hardware partners are getting in exchange, but there are mentions of intellectual property which suggests that it may allow partners to take advantage of (some of its) patent portfolio.

Photo Credit: Andresr/Shutterstock
How B2B eCommerce is evolving in the cloud [Q&A]

Publié: février 11, 2016, 5:10pm CET par Wayne Williams

Modern IT architectures have opened commercial off-the-shelf software categories to new forms of innovation. But still, most B2B eCommerce solutions have yet to evolve. The result is that many firms are left with outdated, in-house infrastructures or bulky SaaS tools that hamper operations, leave customers unsatisfied and can’t keep up at the speed businesses demand. Developers today who work with B2B eCommerce tools gravitate toward cloud-based platforms that are more comprehensive, agile and customizable. This allows for the creation of services and workflows that meet their unique needs.

I spoke with Steve Davis, chief technology officer at Four51, which powers B2B eCommerce for over 10,000 businesses and nearly 20 million users, about what B2B eCommerce solutions should entail and what developers’ priorities are -- or should be -- when building a modern day eCommerce site.

BN: Can you elaborate on how modern IT architectures have changed the way companies operate?

SD: As companies upgrade their technologies to take advantage of current web, mobile and automation capabilities, most realize they need to update their technology stack. As such, increasingly these firms are seeking out cloud-based systems for their sales, marketing, eCommerce, ERP and other systems, and leveraging APIs as necessary to connect to other software and point solutions.

For example, now companies no longer have to build out complex tax logic in their own systems or build their own functionality for mobile since tax software such as Avalara or a mobile platform such as Twilio can be leveraged via API.

ProgrammableWeb has been tracking this "API Economy" for the past several years, and they’ve noted the growth of web APIs from fewer than 10 in 2005 to over 14,000 in 2015. That connective tissue, in that broad of an ecosystem, is new to the world and it is unlocking immeasurable efficiencies, innovation and growth.

BN: Despite these new forms of innovation, most B2B eCommerce solutions have yet to evolve. Why do you think that’s the case?

SD: Salesforce pioneered cloud technologies beginning in 1999, and initially the concept of the cloud was a tough sell, especially with the more conservative technology, security and back-office positions in the enterprise.

The cloud has now become pervasive primarily in the front-offices of sales and marketing, but the back-office has still been slow to adopt. Despite new forms of eCommerce innovation, they have been slow to catch on due to a false notion many enterprises have about the cloud and the fact that enterprises are unaware of the benefits in scalability, cost, and speed the cloud provides them.

Status quo has been easier for these large, risk-averse organizations, so they continue with their expensive, in-house or on-premise solutions controlled entirely by their own employees, rather than "renting" via subscription a lower cost SaaS or customizable PaaS solution.

Also, decision makers should consider that authoritative publications and research groups like the Wall Street Journal and Gartner have made it clear that the cloud has significant IT security advantages over on-premise solutions.

BN: What makes cloud platforms a better answer for developers who work with B2B eCommerce tools? Are there any drawbacks?

SD: Three main drivers of cloud platforms as being superior for developers include the low cost of cloud, scalability and the connectivity APIs afford. The cloud is simply a more economical and scalable way to manage eCommerce. It also allows for updates more easily in the future.

The advent of REST APIs, coupled with cloud enables developers to build exactly what they want, integrate with existing systems and launch a superior solution for their customers.

BN: What would you say developers should prioritize in terms of tools for building modern day eCommerce?

SD: It is vital that developers maintain a high degree of agility. The capability to release software daily is essential. In order to accomplish that, teams must support continuous integration, automated regression testing and collaboration with customers. The ability to react to customer needs quickly will enable the delivery of the best experience possible.

Additionally, all software created must be usable on every device. Responsive web design is a requirement now and no longer just a "nice to have".

BN: What are the most important features and functionality?

SD: The most important features and functionality are in the eye of the beholder. The customer knows how they want to do business and the software created needs to support that explicitly. That requires a robust data model, exposed through an API, that can be leveraged to create the custom workflows. The software should be molded to your business practices rather than the business molding to the software.

BN: More generally speaking, how do B2B commerce systems fit into broader digital ecosystems?

SD: B2B eCommerce is emerging from its former spot in the back-office to a forward-looking, customer-facing technology. If you look at all industries today you’ll note the trend we call "Digital Self-Service".

This refers to technologies that enable customers to help themselves using friendly digital user interfaces. Whether you’re booking a flight, making a restaurant reservation, buying a ticket to a movie, or even purchasing your burger at McDonalds, the chance that you are doing it digitally via mobile, web or kiosk is higher than ever. B2B eCommerce is the next evolution of that journey -- now putting full digital self-service into the hands of B2B customers.

Photo Credit: Nonnakrit/Shutterstock
Microsoft introduces Windows 10 Mobile update history page

Publié: février 11, 2016, 4:24pm CET par Mihăiță Bamburic

Microsoft has decided to give more information about the updates it releases for Windows 10 by introducing a dedicated update history page on its site, where you can check all the major changes that the software giant includes. And, so that users of its new smartphone operating system are not left in the dark either, Windows 10 Mobile now also gets the same treatment.

However, before you get too excited, just like the update history page for Windows 10 is not exactly filled with all the relevant information you might need, the update history page for Windows 10 Mobile is not yet ready for prime time either.

Microsoft seems to have only started working on the page, because no update has yet been mentioned or detailed on it. Microsoft has not officially launched Windows 10 Mobile, as strange as that may be, even though the OS is shipping on smartphones like Lumia 950 XL and Lumia 950.

Even though the said page is now void of any update information, Microsoft has, in fact, released updates for Windows 10 Mobile, for the Windows Insider program and customers who are using the version of the OS that debuted alongside the two handsets -- the final-but-not-so-final release, basically.

With MWC 2016 coming this month, Microsoft is likely waiting to make the big announcement sometime during the conference. Or, perhaps, given the state that Windows Phone is in now, it will not bother at all. Few people would be waiting for it anyway.
The Internet Archive now lets you run over 1,000 Windows 3.1 programs in your browser

Publié: février 11, 2016, 4:05pm CET par Wayne Williams

Windows 3.1 was the first version of Windows I ever used. The Internet Archive, which has over the past couple of years made it possible to play classic DOS games and console games in your browser, has just added over 1,000 Windows 3.1 programs to its catalog.

These include games, utilities and business software, and each can be run in your browser just by clicking on them.

Obviously, with over 1,000 titles to choose from, you’re going to be struggling to find the really good ones to try without a bit of help, but fortunately the Internet Archive has curated some of the best here.

Highlights of the Windows 3.x Showcase include a Windows 95 demo (something to look forward to!), Merlin: The Quest for the Wand, Election 92, Windows Adventure (a GUI edition of the classic Crowther and Woods' game), Taipei, and WinTrek.

If you prefer, you can browse the complete software library here.

Did you use Windows 3.1? If so what programs and games do you remember from "back in the day"?
The top threats to watch for in 2016

Publié: février 11, 2016, 4:01pm CET par Ian Barker

Messaging and infrastructure security specialist Cloudmark has released its Annual Global Threat Report for 2015 which reveals the biggest current threats based on its crowd sourced security platform, which analyses user behavior from more than a billion subscribers.

Top of the list is the Swizzor malware which delivers unsolicited ads, modifying browser settings without user permission. This silent threat delivers booby-trapped emails to unsuspecting users with varying subject lines. Each email contains a zip file carrying the malware payload, this uses a simple domain generation algorithm for command and control synchronization to create a large number of domains that then clash with legitimate websites and make it difficult for them to be taken down.

Senior marketing consultant Pam Strayer writing on Cloudmark's blog says, "This under-the-radar malware uses novel URL naming conventions with common, simple words to disguise itself as normal traffic. Appearing as normal email traffic, the malware attempts to subvert typical email security and character distribution analysis".

Shortened links were another major concern in 2015 with 25,000 different malicious links detected, of which 97 percent are email spam. Spammers are using this method as an easy way to generate an unlimited number of call-to-action URLs that redirect to a server hosting storefronts and spam content. By using multiple links it's harder for spam filtering to detect them all. This activity also reflects badly on major brands, the CNN.it URL shortener for example has been abused, peaking at 8,800 malicious URLs in a single day on 11th Jan 2016.

Cloudmark reports that 91 percent of firms have experienced a spear phishing attack and that this is costing companies $1.6m annually. In a surprising development the report also shows that Germany has become the biggest spammer in Europe, sending more junk email than Russia, India and China.

Cloudmark expects that as the Internet of Things creates more uses for connected devices and intelligence, criminals will find a way to take advantage for malicious purposes. For example a home security system could be hacked and instructed to unlock a door to allow a thief to enter -- or perhaps lock a victim in. Other possibilities include, spying on conversations, or filming people in the privacy of their homes using smart TVs connected to webcams.

Other predictions are that zero day exploits will become so valuable that they may be deliberately introduced by developers so that friends can claim the bug bounty. The report also forecasts that the UK's Investigatory Powers Bill will cause other major Internet companies to follow Yahoo's lead and move their operations out of the UK to avoid being subject to this law.

The full report is available to download from the Cloudmark website.

Image Credit: underverse /Shutterstock
More consumers now care about how businesses handle their data

Publié: février 11, 2016, 2:55pm CET par Sead Fadilpašić

Nearly three million Brits have decided to leave a service provider that got hacked, a new research by security firm Privitar reveals. The report shows that 23 per cent of Brits have been affected by a security breach at some point, and 24 per cent of these reacted by switching providers.

The company says consumers now pay attention to how well a company handles data, when making choices. Even though data handling has become one of the key selling points for many companies, 52 per cent of consumers say it’s difficult to find any information on how companies store and use their personal information.

Consumers are not ones to stick around, though -- 83 per cent have said they’d gladly switch to another service, if they believed it could manage their private data better.

"High profile breaches such as those at TalkTalk and Ashley Madison mean that the issues of privacy and data protection have entered mainstream consumer consciousness", said Privitar CEO Jason du Preez.

"People are taking a more active interest in how their data is used day-to-day. Organizations have two years to comply with GDPR, but those that are proactive can gain competitive advantage by winning customer trust. Organizations should look to adopt leading technology solutions to add privacy protections, particularly as part of big data analytics infrastructure and clearly communicate with their customers as to how they are protecting and using their data".

The GDPR (General Data Protection Regulation) is expected to become law by May, and it will force companies to adopt Privacy-by-design in new information architectures.

Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.

Photo credit: Johavel / Shutterstock
LG announces Quick Cover for yet to be unveiled G5 flagship

Publié: février 11, 2016, 2:30pm CET par Mihăiță Bamburic

LG is certainly tackling the launch of its upcoming G5 flagship differently than other major players. Earlier this month, when it announced the event during which the Android smartphone will be presented, it officially referred to it as G5. The company has also revealed that it would arrive with a so-called Active Display.

But that is not all. Unlike other manufacturers which mention official accessories right after showcasing their latest flagship, LG has decided to talk about G5's Quick Cover ahead of the handset's unveiling next week.

Using LG's own words, "Known as a company ahead of the times, LG took this characterization to heart by revealing the existence of the accessory before the actual product".

This is another unusual situation, because when it comes time to discuss smartphone cases, manufacturers tend to also show how the device they are meant for fits inside. This time, because we will not know what G5 looks like until February 21, the smartphone is hidden.

What you need to know about Quick Cover is that it is designed with G5's Active Display in mind, meaning it will enable users to, for instance, take calls without opening the cover to swipe on the display.

LG has not discussed Active Display to fully understand what advantages it offers, but it is clear that it will enable certain things to be displayed while it appears to be turned off, similar to how the Glance screen functionality works on Lumia Windows Phones.

Information on the display is visible through the case as well, for convenience purposes -- LG says that with the case on, G5 users also will be able to check the time and notifications.

The case will be on display at MWC 2016. There is no word on availability or pricing, but we can, of course, expect it to be on sale after G5 hits the shelves.
Dating apps -- the good the bad and the ugly

Publié: février 11, 2016, 12:47pm CET par Ian Barker

It's coming up to Valentine's Day, so inevitably the IT industry turns its thoughts towards dating apps. Two new reports show that the apps may not be living up to expectations, and that users of them could be revealing more than they intend to.

New research from app quality researcher Applause shows that consumers are more dissatisfied with dating apps than any other type.

The research looked at 97 apps, with a minimum of 2,000 app store reviews, which received a quality score based on consumer sentiment on a 0-100 point scale (100 being the best score). Overall, the dating apps lagged all other apps in quality by 23 points.

Just 11 dating apps earned quality scores of 50 or more with more than 10,000 app store reviews, including OKCupid and GROWLr by Initech. Tinder dropped by over 10 points in the last year, since Applause's first report on the category last February.

Consumers have high expectations when it comes to their dating app's style, privacy and security. The report concludes that, "Brands looking to improve their app quality in the eyes of users would be wise to invest in usability and security audits to prioritize product improvements". The full version is available on the Applause website.

As if that wasn’t bad enough news for the industry, software management specialist Flexera has issued a report which shows that many popular dating apps could present a security risk for enterprises when installed on BYOD devices.

Of the 25 popular Apple iOS dating apps tested 88 percent, including Grindr, OKCupid and Tinder, are capable of accessing a device's location services. 76 percent support ad networks and 60 percent are capable of accessing the device's social networking apps as well as SMS/Texting functions.

36 percent, including Grindr, Lovestruck and OKCupid, are capable of accessing the device's calendar, and 24 percent, including Blendr, Hinge and Tinder, are capable of accessing the address book.

The full report is available on the Flexera website and there’s an infographic summary of the findings below.

Photo Credit: JoeyBear/Shutterstock
The problem with current 'smart' access control systems

Publié: février 11, 2016, 11:49am CET par Hector Hoyos

There’s been an explosion in products that promise to make our facilities, assets, networks and cloud resources "smarter", more secure and safe, but do they?

With control system hacks on the rise and traditional lock/entrance manufacturers like Honeywell, Assa Abloy and Stanley developing more intelligent lock systems, it’s clear that enterprises in hospitality, healthcare and government are looking for a more granular access control that increases security.

These smart access control systems frequently use an RFID, keypad entry, sensors or radio receivers for remotes or smartphones to grant access. To switch over to these systems, there’s usually a very large upfront cost as infrastructure of the network and power must be installed to all controlled access doors, the door hardware must be replaced, and a central system established. Additionally, these systems require backup power options in case of a power loss, and cards and badges must be issued to each employee.

But what happens if your employee loses an access card? There’s a chance it could get into the wrong hands.

This is certainly an issue for concern, but the true root of the problem with current smart access control systems isn’t simple human error. It’s that most of these current systems are connected to facilities’ business networks, like Z-Wave, NFC or WiFi, making the switches, gates and locks being controlled remotely accessible. This might sound convenient, but it’s actually making these smart access control systems accessible for remote attacks because of how easy their frequencies can be scanned and hacked into. It’s as simple as searching on YouTube to find "how-to" videos on hacking physical access control systems.

Whether it’s a malicious attacker or disgruntled employee, if the attacker was to gain access into a server room or an office building they could put your whole organization at risk. Attackers could steal easy-to-grab devices with sensitive information on them, delete and alter information, disrupt normal business operations, hack into a system and cause a data breach or worse -- physically harm your employees.

So is there an alternative? Biometric security in smart access control systems have significant advantages over all other forms of identification, authentication and verification. It’s fast and easy to use; it doesn’t need a token or fob. And unlike a key code password, which requires memorization and is easily replicable, an individual’s fingerprints, irises, facial constructs and other biological traits should be impossible to duplicate.

However, companies need end-to-end security frameworks that encrypt and protect biometric information to ensure the proper level of authentication and verification -- limiting access to a physical location. After all, the threats to data are everywhere. For instance, many companies believe that because their location is controlled remotely by their phone or computer, the data inside is safe. To the contrary, thieves can install malware into the device and gain access into a location without direct contact. Data breaches have been similarly achieved through email, apps and the interception of a Wi-Fi connection.

Standards also matter when dealing with biometric-based access control systems. Without having proper standardization in place to clearly secure and authenticate someone’s identity in a comprehensive manner, information is left open to attack.

For biometrics, the Institute of Electrical and Electronics Engineers (IEEE) has created the Biometric Open Protocol Standard (BOPS) or as it’s called, 2410. With this, organizations can create and use biometric-based technologies that allow people to safely and effectively authenticate access into secure locations without the need of key cards and passwords.

In the coming years, biometrics have the potential to be the leading security metric for smart access control systems, but a single ultra-hack could derail this progression permanently. It’s up to today’s companies to recognize the importance of protecting biometric data, as this is vital step for protecting its assets in the future.

Photo credit: ra2studio / Shutterstock

Hector Hoyos is the founder and CEO at Hoyos Labs, one of the leading innovative biometrics, authentication and identification technology companies. He’s been in the biometrics and IT fields since the mid-1980s as the founder and president of various cutting-edge companies.