November 21st, 2015 | Edited by Zoran Stosic | software
Fortunately, Google is already aware of the exploit, but it’s another sign of how essential regular security updates have become.
A security researcher revealed a new exploit that could allow someone to take control over someone else’s Android phone remotely with just one Chrome link.
Researcher Guang Gong showcased this nefarious plan at MobilePwn2Own, part of Tokyo’s PacSec conference. The full details weren’t revealed, in order to deter anyone with malicious intent from putting it into action.
Luckily, a member of Google’s security team was at the event, so Google will soon be at work on a patch (along with offering a hefty reward bounty for Gong). As long as you avoid sketchy websites and stick to the Play Store for downloads, you should be fine, but it’s always to good to keep an eye on the security landscape.
Why this matters: The Stagefright vulnerability raised the issue of Android security to a higher level because of how easily someone could unknowingly infect their devices from an MMS message. In response, Google now sends out a monthly patch to Nexus devices, while other hardware makers have said they’re going to also step up their security game. It’s badly needed, as Android’s large marketshare demands a robust security structure and update system.
For comprehensive coverage of the Android ecosystem, visit Greenbot.com.
November 19th, 2015 | Edited by Zoran Stosic | software
Google is now letting iPhone and iPad users take a cutting-edge version of its browser for a spin.
Google is now letting iPhone and iPad users take a cutting-edge version of its browser for a spin. The company on Friday quietly launched a new Chrome for iOS public beta program, which leverages Apple’s TestFlight system to give users the chance to try out a new version of the browser.
Users can sign up by going to Google’s Chrome Beta page on their iOS device, and they’ll then be taken to a form where they can enter their name, email address and agree to Chrome’s terms of service. After that, Google will send an email to confirm their email address.
Opting into the beta program ought to give users access to a version of the Chrome app that will have features before consumers get access to them. According to a post by 9to5Mac, that includes a new app icon that takes advantage of the 3D Touch capabilities built into the iPhone 6S and 6S Plus.
Users can press down hard on the Chrome beta icon and get a quick access menu for running a Web search and opening new tabs in both a standard browser window and Chrome’s Incognito Mode.
However, while it’s possible to put in your name for inclusion in Google’s beta program, it’s not clear how many people will actually get access to it. Apple now allows developers to test early versions of their apps with up to 2,000 people through TestFlight, and it seems like Google has already hit that cap. I applied to join the program with two different email addresses (one already associated with a TestFlight account, one not) and neither of them have been invited to join the beta.
Google may be taking in sign-ups and then weeding out inactive users in order to make room for other testers, but it seems like this program is likely going to be limited to an elite few, at least for the time being.
Like other beta software offerings, the Chrome beta isn’t designed to be the best option for people who want a bug-free browsing experience. Instead, the best people to take part in this testing will be those who want to try out the latest features and don’t mind a few rough edges.
November 17th, 2015 | Edited by Zoran Stosic | software
Domain-joined Windows computers that use BitLocker should be patched as soon as possible.
Companies relying on Microsoft BitLocker to encrypt the drives of their employees’ computers should install the latest Windows patches immediately. A researcher disclosed a trivial Windows authentication bypass, fixed earlier this week, that puts data on BitLocker-encrypted drives at risk.
Ian Haken, a researcher with software security testing firm Synopsys, demonstrated the attack Friday at the Black Hat Europe security conference in Amsterdam. The issue affects Windows computers that are part of a domain, a common configuration on enterprise networks.
When domain-based authentication is used on Windows, the user’s password is checked against a computer that serves as domain controller. However, in situations when, for example, a laptop is taken outside of the network and the domain controller cannot be reached, authentication relies on a local credentials cache on the machine.
In order to prevent an attacker from connecting a stolen, lost or unattended laptop to a different network and creating a spoofed domain controller that accepts another password to unlock it, the authentication protocol also verifies that the machine itself is registered on the domain controller using a separate machine password.
This additional check doesn’t happen when the controller cannot be reached, because the protocol developers assumed that the attacker can’t change the user password stored in the local cache. However, Haken figured out a way to do it—and it only takes a few seconds if automated.
How it works
First, the attacker sets up a mock domain controller with the same name as the one the laptop is supposed to connect to. He then creates the same user account on the controller as on the laptop and creates a password for it with a creation date far in the past.
When authentication is attempted with the attacker’s password on the laptop, the domain controller will inform Windows that the password has expired and the user will automatically be prompted to change it. This happens before verifying that the machine is also registered on the controller.
At this point the attacker will have the ability to create a new password on the laptop, which will replace the original one in the local credentials cache.
Logging in while connected to the rogue domain controller would still fail, because the controller does not have the machine password. However, the attacker could disconnect the laptop from the network in order to force a fallback to local authentication, which will now succeed because only the user password is verified against the cache.
This is a logic flaw that has been in the authentication protocol since Windows 2000, the researcher said. However, physical access did not used to be part of the Windows threat model, because in such a situation an attacker could boot from an alternative source, like a live Linux CD to access to the data anyway.
That all changed when BitLocker was introduced in Windows Vista. Microsoft’s full-disk encryption technology, which is available in the professional and enterprise editions of Windows, is specifically designed to protect data in case a computer is stolen or lost—in other words when an unauthorized individual has physical access to it.
BitLocker stores the data encryption key in a Trusted Platform Module (TPM), a secure hardware component that performs cryptographic operations. The key is unsealed from the TPM only if the same boot process is followed as when BitLocker was first activated.
The various stages of the boot process are cryptographically verified, so an attacker with physical access to a BitLocker-enabled laptop will not be able to boot from an alternative OS to read the data stored on its drive. The only possibility left for the attacker in this case is to boot normally to unlock the encryption key and then to bypass the Windows authentication to gain access to the data, which Haken’s attack allows.
Microsoft fixed the vulnerability Tuesday and published the corresponding MS15-122 security bulletin.
This attack shows that when it comes to security, we constantly need to reexamine old truths, Haken said.
BitLocker offers the option to enable preboot authentication using a PIN or a USB drive with a special key on it, in addition to the TPM. However, such configurations are a hard sell for enterprises, because they introduce friction for users and make it difficult for administrators to remotely manage computers, Haken said.
In its own documentation, Microsoft admits that preboot authentication is “unacceptable in the modern IT world, where users expect their devices to turn on instantly and IT requires PCs to be constantly connected to the network.”
November 14th, 2015 | Edited by Zoran Stosic | hardware
For $100, you can secure the company’s latest take on a virtual reality headset.
Samsung’s improved, cheaper mobile VR headset is ready for the taking. Well, the ordering, anyway.
You can pre-order the new Gear VR directly from Best Buy for $99.99. Unlike the developer-oriented unit that Samsung let out into the wild last year, the new hardware works with the Galaxy S6, S6 Edge, S6 Edge+, and Note 5.
Samsung hasn’t indicated if it will work with future smartphones, as we’ll certainly see another round of Galaxy devices at some point in 2016. However, Samsung has promised a lot of content, such as a 16GB microSD card with “3D movie trailers and 360-degree videos.” Other support includes Netflix, Twitch, Vimeo, and Hulu streaming.
The Samsung Gear VR has a release date of November 20.
Why this matters: With such a low entry-point on price, the Gear VR is a pretty solid way to get your first taste of virtual reality. Of course, the budget price of the headset is offset by the $600+ phone you need to use it with. Of course if you want to go even cheaper, there’s Google Cardboard, which is compatible with practically any modern smartphone. There’s a lot of momentum around this technology. For example, YouTube recently announced you can reconfigure any video for VR.
November 12th, 2015 | Edited by Zoran Stosic | software
Maybe you like Google. Or Yahoo. Or DuckDuckGo. Choosing your own search engine just takes a few steps.
Microsoft, of course, would rather you used its Bing search engine in its browser running inside its operating system. But you don’t have to. Even if you’d prefer to stay with Microsoft’s browser, you can change that browser’s default search engine.
I’ll give you instructions for both Internet Explorer 11 and Edge.
[Have a tech question? Ask PCWorld Contributing Editor Lincoln Spector. Send your query to firstname.lastname@example.org.]
Internet Explorer 11
In Internet Explorer, go to the Internet Explorer Gallery webpage. Scroll down a bit, and you’ll find a block of add-ons. Some of them, such as Google and Yahoo, will be clearly labeled as Search.
Here’s the unfortunate part: If your preferred search engine isn’t on this page, you can’t make it your default. You can make Google or Yahoo your default, but not, for instance, the privacy-friendly DuckDuckGo.
Click your preferred search engine (or at least the best in the group). This will take you to another webpage, where you can click the Add to Internet Explorer button.
In the resulting Add Search Provider dialog box, check Make this my default search provider and click Add.
That’s it: you’ve changed Internet Explorer’s Search provider.
Just about any search engine works here, including DuckDuckGo.
First, go to your preferred search engine’s main page. You don’t have to do anything there. You just have to bring up the page in Edge. Then follow these instructions:
1. Click the menu icon (three dots) in the top-right corner and select Settings
2. Scroll down the Settings panel, then find and click the View advanced settings button.
3. Scroll down the Advanced settings panel to “Search in the address bar with.” Click the pull-down menu. You’ll find two options: Bing and <Add new>. Click <Add new>.
4. Here’ you’ll find all of the search engines you’ve visited. Select the one you want and click Add as default.
That’s it. Edge will now default to your favorite search engine.