OS Flaw Leaves Android Wide Open for App Hack Attacks

A flaw in Android's GUI framework let university researchers hack into applications with up to 92 percent success rate.

They tested apps from Gmail, H&R Block, Newegg,WebMD, Chase Bank, Hotels.com and Amazon.

"Changes in the shared memory side channel allow an attacker to infer if there is an activity transition going on in the foreground," researcher Zhiyun Qian, an assistant professor at the University of California at Riverside, told LinuxInsider.

"This is a design choice by modern OSes ... . The same attack may work as well [on other mobile OSes]," he added.

Details of the Flaw

When a new screen or window is shown, the GUI framework allocates a fixed amount of memory in the shared memory register that's proportional to the size of the screen, Qian said. This memory is allocated inside the app process and shared with a separate window compositor process.

Shared memory is commonly adopted by window managers to receive window changes or updates from running applications. This gives rise to the side channel.

When a user downloads a malicious app, the shared memory lets attackers steal information such as login credentials, and obtain sensitive camera images such as photos of personal checks sent through banking apps.

Existing attacks can be enhanced in stealth and effectiveness by providing the target UI states; further, user behavior can be inferred by tracking UI state changes.

How the Attack Works

The researchers first built a UI state machine based on UI state signatures constructed online.

In real time, they inferred UI states -- called "activities" in Android -- from an unprivileged background app.

They then exploited the designed functionality that allows UI preemption, commonly used by alarm or reminder apps on Android, to break the GUI integrity.

"This is akin to a combination of other well-known flaws such as the Trojan Horse approach," Al Hilwa, a program director at IDC, told LinuxInsider.

Trojan Horses capture user data with a decoy UI before error messages are put out, and the real app is brought up once the data is stolen. However, in the researchers' attack, "the real app is used but another app is capturing the data, then throwing out an error message," Hilwa said.

The findings put paid to the common notion that downloaded apps cannot interfere with each other.

The Killing Fields

The researchers achieved success rates for their attacks of 92 percent for the Gmail and H&R Block apps; 86 percent for Newegg's app; 85 percent for the WebMD app; and 83 percent for the Chase Bank and Hotels.com apps.

They had the lowest success rate -- 48 percent -- with the Amazon app, because it allows an activity to transition to almost any other activity, making tracking difficult.

"We will shut down the vulnerability on Android first, followed by iOS," James Wu, CTO and COO of Newegg North America, told LinuxInsider. He expects these fixes to be in place by next week.

"At this time, there is no indication that any H&R Block client data has been compromised as a result of this vulnerability," said company spokesperson Gene King.

"H&R Block takes privacy and security very seriously, and we are in contact with appropriate parties to address these reports," he told LinuxInsider.

The researchers had not yet notified Google of the flaw, UCR's Qian said.

On Responsibility and Defense

As for fixing the flaw, Newegg's Wu said, "everyone is responsible -- the OS makers, app developers and phone users."

The researchers "did a good job at pointing out and educating everyone about a possible vulnerability," he continued. "Now it is up to all of us to do something about it."

OS vendors could eliminate the shared memory side channel, Qian suggested, although that could impact backward compatibility. Or they could redesign the GUI framework to avoid frequently allocating and deallocating memory, instead preallocating double the size of the memory. That approach would increase memory consumption, though.

There are "not always perfect solutions," Qian admitted, noting that each imposes its own penalties.

Read More

If the Internet Could Speak: 'I'm Melting! Melting!'

It's most likely going to get worse before it gets better. Internet infrastructure experts have known for years about the problems that would accompany its growth -- but not exactly which problem would strike when. "We'll likely have to see more outages or large cash penalties or government intervention before a problem like this gets fixed," suggested tech analyst Jim McGregor. Oh, what a world. Millions of users were unable to access the Web Tuesday, according to reports. The websites of eBay, Amazon,, Autotrader, LinkedIn, Time Warner and Verizon were among those hit. The problem is due to a combination of factors: router configuration; the explosive growth of connected devices; and IPv4 running out of addresses. "The industry faces many limitations with communications, ranging from wireless spectrum to core network bandwidth, and there is never a single solution to overcome these limitations," Rob Enderle, principal analyst at the Enderle Group, told TechNewsWorld. "The immediate need is a combination of extending the router memory caps and rebooting the routers, plus bundling IP addresses," he continued. The long-range solution is to shift from the Web's current IPv4 protocol to IPv6, "but even IPv6 will eventually face similar limitations," Enderle said. The Trouble With Routers The Internet is really a network of networks, and it is mapped by Border Gateway Protocol (BGP) routers, which store a map of the Web, correlating ranges of IP addresses to the various networks. The BGP makes routing decisions based on paths, network policies, and rules configured by network administrators. The problem is, older Internet routers have a default software limit of 512,000 IPv4 BGP routing table entries. That limit was reached on the routers of several companies, including Internet service providers, on Tuesday, leading victims to dub it "512K Day." The solution seems rather simple: Reboot routers after adjusting the limit. However, "manually rebooting millions of routers is not an easy task, nor one that many companies have worked into their maintenance schedule, because they did not know when they would be affected," Jim McGregor, principal analyst at Tirias Research, told TechNewsWorld. "In hindsight, companies should have been more proactive about addressing the issue," he said. Internet Protocol Issues The Internet Engineering Task Force (IETF) has been concerned that IPv4 will run out of addresses since the 1980s. IPv4 provides about 4.3 billion 32-bit addresses. Each of the five regional registries (RIRs) was allocated 16.8 million addresses. The IETF adopted various technologies, including network address translation (NAT) and Class Inter-Domain Routing (CIDR), and began working on IPv6 in 1998. IPv6 will provide 340 undecillion 128-bit addresses. In efforts to promote IPv6, the Internet Society and several large content providers jointly launched the first World IPv6 Day. Two more were held, in 2012 and last year, and United States federal government agencies have been mandated to switch over to IPv6, but many large organizations have routers that run both IPv4 and IPv6, and others still haven't made the switch. The explosion in the mobile device market contributed to the dearth of available IPv4 addresses. The new 4G LTE devices use IPv6, by the way, which is why the mobile industry is pushing them so hard. The Role of ISPs Some ISPs are among the companies that have not switched to IPv6, as Tuesday's meltdown showed. "Moving to IPv6 generally means you have to replace a lot of older hardware and this is an expense many have put off for too long," Enderle said. However, transiting to a new communications protocol "is difficult when the older protocol has already reached critical mass," Tirias' McGregor pointed out. "IPv6 hasn't really taken off yet, and that is becoming a bigger and bigger problem." Further, the switchover has to occur in stages. "The entire industry does not just drop one protocol and adopt another overnight," McGregor continued. "This happens over time as new products are introduced and communications platforms are upgraded." Upgrading communications platforms is the slower process of the two, because companies want to realize returns on the very heavy investment these platforms require, McGregor said. "We'll likely have to see more outages or large cash penalties or government intervention before a problem like this gets fixed," McGregor suggested. "It is incredibly expensive, and infrastructure investments are really hard to fund unless there's a lot of pressure to do so."

Read More

World’s fastest camera shoots 4.4 trillion frames per second

Japanese researchers have developed the world’s fastest camera, capable of snapping an incredible 4.4 trillion frames per second.

                                                                                                                                     Image: University of Tokyo

This new camera is around 1,000 times faster than any other camera in the world, and is powered by a brand new technique for capturing images, known as Sequentially Timed All-optical Mapping Photography, or STAMP.

The former fastest cameras in the world create images via the so-called 'pump-probe process', in which light is ‘pumped' at the object it's photographing, and then ‘probed' for absorption. But this new camera has employed the STAMP technique, which works by shooting ultra-fast, single-shot bursts of light at an object to capture its image. This process is so much faster and more efficient because it can map an object over time very quickly, therefore skipping the repetitive measures that the pump-probe process relies on to create its images.

"The STAMP has been proposed to improve the study of chemical reactions and heat conduction, which travels around six times slower than the speed of light,” says Chris Higgins at Wired UK. "The teams, split between Keio University and the University of Tokyo, have been working on a STAMP camera for the past three years, and hope to continue to do so now that their findings have been made public.”

The researchers describe their technology in the journal Nature Photonics, and are now working on scaling it down to prepare it for the commercial market. They hope to see it used in several medical applications, and to study fast dynamics in photochemistry, phononics, and plasma physics.

Read More

Galaxy Alpha: Samsung Puts Pedal to Metal

Samsung on Wednesday unveiled its long-awaited Galaxy Alpha smartphone featuring a metal frame and a 4.7-inch HD Super AMOLED display.

"We have taken a new approach to smartphone design with the Galaxy Alpha, focusing on sophisticated design techniques and compact construction, while building upon the Galaxy experience," Samsung spokesperson Ashley Gregory told LinuxInsider.

Despite the device's new metal frame, solid finish and lightweight design, however, the Galaxy Alpha "still provides users with the same powerful hardware and features they can expect from a flagship Galaxy mobile device, including efficient battery consumption, finger scanner and an advanced camera," Gregory added.

Android 4.4.4 (KitKat) runs the device, which comes with 2 GB RAM, 32 GB internal memory and a 1,860-mAh battery. It also has real-time high-dynamic-range imaging, as well as an ultra-power-saving mode, private mode, the S Health app, and connectivity with the latest Samsung Gear Fit, Gear Live and Gear 2 wearables.

The Galaxy Alpha will be available in early September; depending on the market, color choices will include charcoal black, dazzling white, frosted gold, sleek silver and scuba blue. Pricing has not yet been disclosed.

'Samsung Could Have Pushed Even More'

"The emphasis here is on style and design -- period," Ramon Llamas, research manager for mobile phones with IDC, told LinuxInsider. "This is a direct response to some of the criticisms leveled at other Galaxy devices that seemed to be cutting corners in terms of materials."

The Galaxy S III, S4 and even S5 have been criticized for having flimsy backing, Llamas pointed out.

"Meanwhile, the rest of the device was plastic," he said. "This responds to that and says, 'here's our aesthetically pleasing device.'"

Although the Galaxy Alpha does mark a change from Galaxy devices of the past, Samsung "could have pushed even more" on the design front, Llamas maintained, particularly given that the feature set isn't all that different from those of the other devices.

HTC's One M8 is a shining example, he said.

"It's a beautiful device. The chassis is completely made of metal. It's a little on the heavier side, but not so much that it's like bench-pressing. It feels great in the hand, with the brushed metal on back, and a lot of folks out there are saying Samsung could have done the same kind of thing, but less expensively," Llamas observed.

'The Anti-Apple'

Of course, while relatively small for Samsung, the 4.7-inch screen size will be pushing the larger-size boundaries for Apple, Wayne Lam, senior telecom electronics analyst at IHS, told LinuxInsider.

That is a result of the two companies' different approaches to the global smartphone market, which has matured dramatically over the years to include widely varying regional preferences, he said.

Asian countries and many developing nations tend to prefer larger devices, for instance, at least in part because "for a lot of these consumers, it's the first true computing device they will buy," Lam explained. European nations, meanwhile, tend to prefer smaller, more compact devices.

Samsung is in many ways "the anti-Apple" in that it tends to cater more to regional tastes, he noted.

"It is an interesting dynamic," Lam concluded. "It all speaks to the fact that the market has become hypercompetitive."

Read More

Nokia X2 Mixes and Matches Android Apps, Windows Phone Services

Microsoft is "capitalizing on some of Nokia's product development prior to its acquisition," said Yankee Group analyst Carl Howe. "It costs Microsoft little at this point to test the waters to see if an Android-based phone with a Windows-like user interface might find an audience." This approach -- developing phones with an Android kernel but no Google services -- is becoming a trend. Microsoft on Tuesday announced the launch of the Nokia X2, the first device to come out in Nokia's Android-based X line since Microsoft acquired the company earlier this year. The Nokia X series targets emerging markets with a low-cost family of smartphones offering access to Android apps and Microsoft services. However, the new Nokia X2 offers an enhanced experience, with more Microsoft services, an updated Fastlane feature, and upgraded specifications including a 4.3-inch ClearBlack display and 5-MP rear camera with autofocus and flash. Priced at 99 euros, the Nokia X2 initially will be available as a dual-SIM device in glossy orange, black and green, with glossy yellow, white and matte dark grey coming later. It will begin rolling out globally in July. Gateway to Microsoft Services The Nokia X2 is powered by a Qualcomm Snapdragon 200 processor featuring a dual-core 1.2-GHz CPU and 1 GB of RAM. It debuts the Nokia X Software Platform 2.0, which features major enhancements to the user interface. Three types of screens can facilitate navigation: a colorful Home, with resizable tiles; Fastlane, to access recent apps and future calendar items; and a new, Lumia-inspired apps list from which users can pin items to the home screen. Outlook.com, Skype and OneDrive are among the services that come preloaded with the device, but many more -- including OneNote, Yammer and the Bing Search app -- can be found in the Nokia Store. Microsoft describes the Nokia X family as a gateway to Microsoft services. Android - With Branding Indeed, while Nokia X devices technically run Android, Microsoft adds considerable branding, so that "you're not going to see Google Maps and all those Google properties," Ramon Llamas, research manager for mobile phones with IDC, told LinuxInsider. "Yes, it's an Android phone, but does it look, smell, feel like one? I'm going to go with 'no.'" At the same time, "this is a great way for Nokia/Microsoft to bring Microsoft assets to the masses, particularly in entry-level markets where price sensitivity is high," Llamas opined. Android is commonplace in such markets, but Windows Phone "really isn't there," he noted. The operating system is no longer as important to Microsoft as the applications and the services, and "they see Android as a way of getting into the low-end device market," agreed Chris Hazelton, research director for mobile and wireless with 451 Research. "I think this is a good stepping stone," Hazelton told LinuxInsider. "If Microsoft is successful with these Android devices, it can then push interest among developers in making apps for Windows Phone." 'There's Going to Be Trade-Offs' What's not entirely clear, however, is an upgrade path for users who start out buying a Nokia X2, Llamas suggested. "Let's say you get one of these X devices and eventually it's time for you to get your next phone," he explained. "If you're going to go from an X phone to the Lumia, there's going to be some trade-offs, and the biggest one is that application story." Specifically, while users of the X line have access to the Android library of apps, the Lumia device taps the smaller Windows Phone library instead. "It's great to get the Microsoft name and assets out there, but after that, what are users going to be faced with?" Llamas wondered. "What's that bridge going to look like going from X to Lumia? It's not totally clear to me." 'More of a Smartphone Engine' In any case, the move is a sign that Microsoft is "capitalizing on some of Nokia's product development prior to its acquisition," Carl Howe, vice president of research and data sciences with the Yankee Group, told LinuxInsider. "It costs Microsoft little at this point to test the waters to see if an Android-based phone with a Windows-like user interface might find an audience in some markets," Howe explained. "Think of it as acquisition-funded market testing: Microsoft only has to pay for the marketing and none of the development costs." What's interesting is that this approach -- developing phones with an Android kernel but no Google services -- is appearing "again and again" in the market, he pointed out. "Amazon just introduced its Fire Phone using that idea and its own apps; Yahoo just announced its Aviate apps that run on top of a Google kernel and that replace Google's services; and of course, most Chinese manufacturers put Alibaba, Tencent and Baidu apps on top of Android," said Howe. "Increasingly, I see Android being more of a smartphone engine than a smartphone user interface," he observed, "simply because so many companies are putting their own interfaces on their phones."

Read More

Taking the Temperature of Java App Security

The JVM has the native ability to modify an app's run-time behavior on the fly without needing to change its source code or binary code. That means it can control the I/O of a Java app and block unauthorized actions without crashing the app. Placing application security capabilities in the JVM can protect Java code without having to make changes to the Java app itself or to impact app performance.

Current approaches to Java application protection place security at the application or the network layer, both of which are problematic. The first approach has proven to be too complex, too time consuming and too risky -- in other words, "too hot."

Meanwhile, network level security that consists of perimeter devices lacks the intelligence to know what's going on inside the application in order to be effective. This approach is "too cold."
A third alternative is to place security inside the Java virtual machine.

Application Layer Protection

Application layer protection is too time-consuming, because the only realistic defense is developer training and retraining, and repeated code testing using automated tools. There is little time for either in today's word of rapid software development.
The automated code tests, meanwhile, are good for finding known vulnerabilities, but provide no protection against ones that do slip through -- or are invented in the future.
In an ideal world, application security would be baked in at every stage of the development process. In theory, that sounds great. In practice, rushed Java programmers often import large chunks of code from third-party code libraries.
No one can say if a given line of code has been tested for vulnerabilities. To attempt true security, developers would have to track the provenance of each scrap of code.
It's too risky, because the stakes are so high. Since enterprises often use Java apps to control access to sensitive information, and since about half of all enterprise apps developed in the past 15 years were written in Java or a Java-derived language, Java is a popular target for attackers.
SQL injection attacks are especially prevalent, and rely on the execution of intentionally malformed or corrupted input, often made possible by code vulnerabilities.

Network Level Security

Perimeter-based application security solutions, including firewalls, intrusion-detection systems, intrusion-prevention systems, or Web application firewalls, etc., lack the intelligence to know what is going on inside the app, and therefore never will be truly effective.
They must permit the passage of authorized traffic while at the same time blocking malicious traffic. However, since these tools do not operate at the application layer, they are unable to discern what authorized traffic should look like at a given moment.
Meanwhile, if they inadvertently block authorized traffic, network security products can fatally disrupt user access to an application.
In the end, administrators must choose between using loose security parameters at the risk of an intrusion, or spending months finding tight parameters that do not "break the app." More often than not, they chose the former, creating significant risks.

Inside-Out Security

But there's a third alternative. In terms of Java app security, that means an approach that analyst firm Gartner calls "runtime application self-protection," or RASP. It performs ongoing security analysis -- with immediate responses to detected threats -- as a native function within the run-time environment, without changing a single line of application code.
One approach for implementing RASP involves leveraging the power of the Java Virtual Machine. Running above the operating system but below the app, the JVM sits between the compiled Java code and the server/OS infrastructure that the Java code runs on.
The JVM has the native ability to modify an app's run-time behavior on the fly without needing to change its source code or binary code. That means, among other things, that it can control the I/O of a Java app and therefore block unauthorized actions and execution of compromised code without crashing the app.
Placing application security capabilities in the JVM can protect Java code without having to make any changes to the Java app itself or to impact app performance. By performing fine-grained monitoring and control of key system behaviors, JVM-based security can provide attack mitigation automatically.
It can block malware-related activity regardless of which code triggered it. This blanket coverage not only counters known vulnerabilities, but also can defeat zero-day exploits, or ones that exploit poor input validation.
In addition to protecting against illicit system behaviors, JVM security can include a rules engine for protection against an entire class of attacks, such as SQL injection or other known vulnerabilities like those recently reported in the Apache Struts 2 open source Web application framework.
Entire categories of security weaknesses and vulnerabilities can be countered with only a small number of rules, which can be applied in real-time, even while the app is running. Waiting for vendor-supplied patches is no longer an issue.
Meanwhile, legacy Java apps get blanket coverage against exploits that otherwise might succeed. A security-enabled JVM can even pass data to developers for use in coding or testing, or to security information event management (SIEM) tools.
JVM-based security that is neither too hot to implement nor too cold to recognize threats is available today.

Read More

You can't change the color of Facebook - it's a virus

An app claiming to change Facebook's color palette is actually loading malware onto your smartphone or PC.

A scam app claiming that it can change the color of your Facebook profile page actually loads malware onto your smartphone or computer.

More than 10,000 people around the world have been duped into downloading the malware, according to a Cheetah Mobile Security blog post.

When Facebook users click on the fake app, it sends them to a malicious website that asks them to watch a tutorial video about how to change the color of their profile page. By agreeing to watch the video, the users give hackers access to their profiles, letting the app spam their friends.

If the user doesn't watch the video, the app will lead PC users to download a pornography video player and smartphone users to download an antivirus app. Both are infected with malware.

The good news is the bad app is pretty easy to get rid of -- just remove the color changer app from the Facebook app settings page. Cheetah Mobile Security also advises affected users to change their passwords.

Read More