Monthly Archives: July 2016

Major Data Breach Deja Vu

Yahoo on Wednesday revealed that Net bandits stole data associated with 1 billion of its user accounts — one of the largest data breaches in Internet history.

The theft, which occurred in August 2013, is distinct from the theft disclosed earlier this fall, in which 500 million accounts were compromised, Yahoo CISO Bob Lord explained.

Stolen information may include names, email addresses, telephone numbers, dates of birth, hashed passwords using MD5 encryption — and in some cases, encrypted or unencrypted security questions and answers, according to Lord.

An unauthorized third party accessed the code Yahoo uses to create cookies, he noted. Access to that code allowed attackers to compromise accounts with forged cookies.

In response to this latest discovery, Yahoo is taking steps to secure the accounts of affected users and invalidate forged cookies, said Lord, as well as to harden its systems against similar attacks.

More Data NickedThis latest breach at Yahoo appears worse than the previous one not only because is it bigger, but also because more-sensitive information was stolen.

“More information was released than just usernames and passwords,” explained Rami Essaid CEO of Distil Networks.

“The bad guys are getting a more holistic look at these users,” he told TechNewsWorld.

The weakly encrypted or plaintext security questions in particular could be problematic, because the answers to those questions don’t change from site to site.

“You can change your passwords, but you only have one mother’s maiden name and one birth date,” Essaid noted.

 

Verizon Deal

How this latest data breach could affect the US$4.8 billion sale of Yahoo to Verizon is unknown. However, after news of the first breach made headlines, Verizon sought to lop $1 billion from the original purchase price, according to reports.

As with the previous Yahoo data breach, Verizon’s official reaction to the latest theft was brusque.

“As we’ve said all along, we will evaluate the situation as Yahoo continues its investigation,” the company said in a statement provided to the E-Commerce Times by spokesperson Rich Young. “We will review the impact of this new development before reaching any final conclusions. We have no additional comment at this time.”

Companies buy other companies for any number of reasons — their customer lists, their technology or their talent, among other things — observed RedSeal CEO Ray Rothrock.

“If Verizon was buying Yahoo for its customers, this is a bad deal,” he told the E-Commerce Times.

 

Merger Downside

If Verizon expected to merge its customer databases with Yahoo’s, it might think twice about that now.

“It’s likely Verizon will avoid merging databases,” said Peter Martini, president of Iboss. “That will impact the value of the acquisition, since a good portion of that value was for Yahoo’s customer database.”

In addition, many Yahoo customers may avoid using the company’s services because of the breach.

“If they see a large exodus of customers, it will further impact the value of the company,” Martini told the E-Commerce Times.

Worse yet, Verizon doesn’t know if there is more bad news down the road, added Mark Graff, CEO of Tellagraff.

A Beast Unleash on Samsung

Hot off the rumor mill on Wednesday is news of a new feature Samsung may include in its upcoming Galaxy S8. It’s dubbed “Beast Mode,” and that’s just about all that is known about it so far.

Spotted in an EU trademark application, Beast Mode would apply to smartphones, mobile phones and application software for smartphones, notedGalaxy Club, a Netherlands-based blog.

The Galaxy S8 is expected to be the first smartphone built around Qualcomm’s Snapdragon 835 processor. If true, that lines up with the notion that Beast Mode could allow super high performance.

Another rumor is that the Galaxy S8 will have an optical fingerprint scanner built into the display instead of the body.

Further, it’s rumored that it will include Bluetooth 5.0, recently approved by the Bluetooth Special Interest Group — and that idea seems to carry a fair amount of weight.

Countering Bad PR”There’s a strong possibility that Samsung will incorporate Bluetooth 5 into the Galaxy S8,” said Ken Hyers, director of wireless device strategies at Strategy Analytics.

“With the cancellation of the Note7, the Galaxy S8 is now [Samsung’s] premier device to showcase the latest and best smartphone technology,” he told TechNewsWorld.

Samsung had to institute a global recall of millions of Galaxy Note7s after multiple instances in which the device spontaneously burst into flames. Some replacement devices also caught fire.

“Samsung has a PR problem,” observed Michael Jude, a program manager at Stratecast/Frost & Sullivan. “Note7 is a disaster, and they need something with which to seize the technological high ground.”

Putting cutting-edge technologies in the S8 “will help a lot,” he told TechNewsWorld.

“Remember, practically nothing is Bluetooth 5-compliant,” Jude noted. “As long as the S8 can talk to existing Bluetooth devices, it’s golden. People will be drawn to the latest, greatest technology.”

Bluetooth 5.0 doesn’t replace 4.0, 4.1 or 4.2. It extends the functionality of these previous versions of the Bluetooth Core Specification.

Further, Bluetooth 5.0 lets manufacturers leverage interoperability and performance improvements incorporated in the core specs since 4.2 was released.

“From Bluetooth headsets and speakers to home control, personal robots and drones, Bluetooth is a default technology for connecting devices, with the smartphone as the hub of consumers’ device universe,” Strategy Analytics’ Hyers remarked.

“We are rapidly moving into a more complex connected device world,” he pointed out.

Samsung has focused heavily on the Internet of Things, offering smart TVs and smart appliances that can be tied to its smartphones.

Bluetooth 5 “is a huge advance over previous versions of Bluetooth from a connectivity speed and capacity standpoint,” Hyers pointed out, noting that it’s a natural fit for Samsung’s next flagship device.

The S8 will “be both a mass market flagship and a showcase for Samsung’s technological leadership” since the company has canceled its Note series of phablets, he said.

Therefore, Samsung “will be careful to only put technology and features in it that it’s certain will not create issues,” Hyers contended. As a relatively low-risk feature, Bluetooth 5 likely will appear in the S8 in Q1 2017.

Glass Speakers on Gadget Ogling

Welcome to another edition of Gadget Dreams and Nightmares, the column that breaks down the latest in gadget announcements to determine if they’d be naughty or nice additions to your stocking.

Hanging on the fireplace this time around are earbuds to improve your hearing, heated insoles, and a small transparent speaker, which is called “Small Transparent Speaker.”

As always, these are not reviews, and you should place no stock into my ratings, beyond their denoting how much I’d like to try each item.

Ear BoostBose’s latest earbuds (pictured above) are designed to help you tune in to the specific sounds you want to hear from the world around you. Hearphones are a sort of blend of noise-cancelling earbuds and hearing aids.

There are several presets in the app, with names like “focused conversation,” “gym,” “airplane” and “television.” You can opt to crank up the volume on all sound from the world around you or turn it down. You can block out noise or amplify it from certain directions.

For instance, you might use it to help you better hear a specific person in a crowded place. Can’t hear what your partner is yelling at a festival? You can temporarily turn up the Hearphones, and turn down the crowd and music (though why you’d have Hearphones in your ears at a live music event is a little beyond me).

It’s not the first time we’ve seen earbuds pull off this sound-augmenting trick, but to my knowledge, it’s the first time we’ve seen a pair like this from a manufacturer as well-known as Bose. The “Bose” name should help Hearphones gain more recognition than they otherwise might, normalizing the concept to a degree.

I like the idea, and there are a lot of practical applications for it. The option to stay laser-focused on listening to what my kid might be up to at a crowded playpark seems like it would be welcome in the alternate reality where I have children. My partner also might be less annoyed at my listening to podcasts while we’re cleaning up if I can hear her over the top of the chatter.

Rating: 4 out of 5 Surround Sounds

 

Winter Warmers

I can’t think of a better time to start a crowdfunding project for heated insoles than when the temperatures start to plummet and there’s a very real chance of cold toes, even while wearing three pairs of socks.

We’ve seen other connected heated insoles in the past, but the +Winter models have some advantages over the competition. They pair with an app over Bluetooth to set the temperature and monitor battery level, and they can charge wirelessly.

Although I’ve been vocal about my dislike of wireless charging and its energy inefficiency, I’d absolutely make an exception here. I’d turn the charger on only when actually using it, and if it meant I could charge the insoles without having to remove them from my boots and carefully refit them afterward, I’d forego my principles for once.

How Gooligan Works

Gooligan-infected apps send data about infected devices to the campaign’s command and control server, then download a rootkit such as Vroot or Towelroot.

That raises the question of why Google hasn’t done anything to prevent the risky activity.

“Support is expensive, and, when you’re Google or any other vendor,” said Michael Jude, a program manager at Stratecast/Frost & Sullivan.

“You have to plan allocation of resources for these things, since there are always user problems,” he told TechNewsWorld.

Once the device is rooted, Gooligan downloads a new malicious module that lets it

  • steal a user’s Gmail account and authentication token information, which bypasses Google’s two-factor authentication and other security mechanisms;
  • install apps from Google Play and rate them to raise their reputation; and
  • install adware to generate revenue.

The malware also fakes device information such as IMEI and IMSI, so it can download an app twice but make it appear that the downloads are on different devices, thus doubling the potential revenue from the apps.

Apps infected by Gooligan include “Perfect Cleaner,” “WiFi Enhancer,” “Memory Booster,” “Battery Monitor” and “Weather.”

 

Protecting the User

Google has removed from Google Play apps associated with the Ghost Push family, and apps that benefited from installs delivered by the malware, Google’s Ludwig noted.

It also has improved Verify Apps to protect users in the future.

Google has notified users known to have been affected by Gooligan. It also has removed their Google Account tokens and provided them simple instructions to sign in securely, Ludwig said.

Further, it has been working with the Shadowserver Foundation, as well as multiple major ISPs that provided the infrastructure used to host and control Gooligan, in order to take down the infrastructure.

Devices with up-to-date security patches are safe, Ludwig said. Those with a system image, like Google’s Nexus and Pixel devices, can remove the malware through a system software reinstall.

Owners of newer devices, including those compatible with Android 6.0, have Verified Boot enabled, and can remove Ghost Push easily, Ludwig pointed out.

Patches often are delayed by wireless carriers because they need to test them for compatibility first.