Security

Multiple Trend Micro Apps Pulled From Mac App Store; Tens of iOS Apps Caught Collecting and Selling Location Data 38

Ahead of Apple's big iPhone event later this week, the company appears to be grappling with a PR problem: Third-party apps on both its desktop and mobile app stores have been caught doing shady stuff. Last week, Apple pulled a top selling app from the App Store, a month after it was alerted about it, but only hours after it started making headlines. Since then, tens of new iOS apps have been caught indulging in a similar offense -- collecting and selling users data such as GPS coordinates, WiFi network IDs and more. Amid all of this, more desktop apps, curiously all from security service provider Trend Micro -- have been caught collecting browser history and information about users' computers. Apple has pulled Trend Micro's apps from the store. Do note that Trend Micro still has some apps -- both for desktop and mobile -- listed on the store. Would be interesting to learn what sort of conversations Trend Micro and Apple have had in the recent days. BleepingComputer: The apps are Dr. Antivirus, Dr. Cleaner, and Dr. Unarchiver, all under the developer account Trend Micro, Incorporated. Until removal, all products were top-sellers, with thousands of positive reviews that averaged their ratings between 4.6 and 4.9. The first public report of a Trend Micro product in the App Store engaging in shady activities came in late 2017 when user PeterNopSled told Malwarebytes forum members that "that his Mac was taken over by Open Any Files: RAR Support," and it did not let him open Word or Excel files. Trend Micro's privacy and data collection disclosure.
The Almighty Buck

New York State Approves Two Dollar-based Cryptocurrencies (engadget.com) 95

Today, New York approved the first digital currencies that are tied to the US dollar, called "stablecoins." From a report: These cryptocurrencies avoid the price volatility of their brethren by being pegged to stable assets. The digital currencies in question, from Gemini Trust Company and Paxos Trust Company, are available to trade on their respective exchanges. The Winklevoss twins, who rose to fame with a lawsuit suing Mark Zuckerberg for stealing the idea for Facebook from them, have become major players in the cryptocurrency world. They are behind Gemini Trust Company. The currency is pegged to the US dollar on a one-to-one basis; the company will hold US currency that corresponds with all issued Gemini dollars at a bank eligible for the FDIC's pass through insurance.
AI

Nearly Half of American Households Will Own a Smart Speaker by 2019, Study Says (fortune.com) 220

Almost half of American households will have a smart speaker by next year, according to a new study from Adobe. From a report: The study, released Monday, finds that 32% of the country already owns a smart speaker and another 16% plan on getting one this holiday season. And just as importantly, people are using those speakers. "Technology trends come and go, but we think voice is here to stay," said Colin Morris, director of product management for Adobe Analytics, in a statement. "Consumers continue to embrace voice as a means to engage their devices and the Internet. It's a trend that has fundamentally changed the face of computing." A notable indicator of the growing popularity of the speakers is how comfortable people are talking to the device in front of others. And that number is on the rise: 72% of smart speaker owners say they use voice assistants in front of others. (Only 29% of people without a smart speaker are comfortable with doing so.) Further reading: Google Home Outships Amazon Echo for Second Quarter in Row.
The Internet

'You Can See Almost Everything.' Antarctica Just Became the Best-Mapped Continent on Earth (fortune.com) 110

Antarctica has become the best-mapped continent on Earth with a new high-resolution terrain map showing the ice-covered landmass in unprecedented detail. From a report: According to the scientists at Ohio State University and the University of Minnesota who created the imagery, Antarctica is now the best-mapped continent on Earth. The Reference Elevation Model of Antarctica (REMA) was constructed using hundreds of thousands of satellite images taken between 2009 and 2017, Earther reports. A supercomputer assembled the massive amounts of data, including the elevation of the land over time, and created REMA, an immensely detailed topographical map, with a file size over 150 terabytes. The new map has a resolution of 2 to 8 meters, compared to the usual 1,000 meters, says an Ohio State press release. According to The New York Times, the detail of this new map is the equivalent of being able to see down to a car, or smaller, when before you could only see the whole of Central Park. Scientists now know the elevation of every point of Antarctica, with an error margin of just a few feet.
AMD

AMD Debuts Ryzen 5 2500X and Ryzen 3 2300X For Prebuilt PCs (techreport.com) 53

AMD announced two new second-generation Ryzen CPUs this morning. From a report: The Ryzen 5 2500X and Ryzen 3 2300X bring Precision Boost 2 and XFR 2 to quad-core Ryzens without integrated graphics, but there's a catch: these chips appear to be available exclusively to system integrators and OEMs for use in prebuilt systems. AMD is debuting the Ryzen 5 2500X in cooperation with Acer in the form of the Nitro 50 desktop PC. AMD says the Ryzen 5 2500X and Ryzen 3 2300X each use a single enabled core complex (or CCX) from the two available on Pinnacle Ridge Zeppelin dies to get their four cores. Recall that the Ryzen 5 1500X instead used two cores from each CCX to get its core count. A consequence of this architectural change versus the Ryzen 5 1500X is that the Ryzen 5 2500X now has 8 MB of L3 cache, down from 16 MB. That puts both the Ryzen 5 2500X and Ryzen 3 2300X on par with the Ryzen 3 1300X and Ryzen 3 1200 on a cache-capacity basis.
Communications

Net Neutrality Gives 'Free' Internet To Netflix and Google, ISP Claims (arstechnica.com) 361

Frontier Communications is asking employees for help in its fight against state net neutrality rules in California, claiming that the rules will give "free" Internet to major Web companies while raising costs for consumers. From a report: The Internet service provider urged employees to submit a form letter asking Governor Jerry Brown to veto the net neutrality bill that was recently approved by the state legislature. Frontier sent an email to employees and set up an online form for them to send the form letter to Brown. "I am proud to work at Frontier and help operate a network that is part of an incredibly successful Internet ecosystem that is the backbone of our economy and daily life," the form letter says. But net neutrality rules "will harm consumers and impose complex layers of costly regulation," and therefore "deter investment and delay broadband deployment in California, especially in rural areas that still lack high-speed Internet access," the letter says. The letter claims that net neutrality rules "will create significant new costs for consumers" but did not make it clear what those new costs would be.
Bitcoin

Crypto Growth Nears 'Ceiling,' Ethereum Co-Founder Buterin Says (bloomberg.com) 87

The days of explosive growth in the blockchain industry have likely come and gone now the average person is aware of its existence, according to Vitalik Buterin, co-founder of Ethereum. From a report: "The blockchain space is getting to the point where there's a ceiling in sight," Buterin said in a Sept. 8 interview with Bloomberg at the Ethereum Industry Summit conference in Hong Kong. "If you talk to the average educated person at this point, they probably have heard of blockchain at least once. There isn't an opportunity for yet another 1,000-times growth in anything in the space anymore." Growth in Bitcoin and other cryptocurrencies in the blockchain community through its first six or seven years was dependent on marketing and trying to get wider adoption, Buterin said. "That strategy is getting close to hitting a dead end," he said.
Privacy

Popular VPNs Contained Code Execution Security Flaws, Despite Patches (zdnet.com) 47

Researchers have uncovered vulnerabilities in popular virtual private network (VPN) software, ProtonVPN and NordVPN, which can lead to the execution of arbitrary code by attackers. From a report: Last week, Cisco Talos security researchers said the security flaws, CVE-2018-3952 and CVE-2018-4010, permit code execution by attackers on Microsoft Windows machines. The vulnerabilities are similar to a Windows privilege escalation security flaw uncovered by VerSprite, which is tracked as CVE-2018-10169. Security patches were applied in April by both clients to resolve the original security hole, but according to Talos, "despite the fix, it is still possible to execute code as an administrator on the system." The initial vulnerability was caused by similar design issues in both clients. The interface for both NordVPN and ProtonVPN execute binaries with the permission of a logged-in user, and this includes the selection of a VPN configuration option, such as a desired VPN server location. This information is sent to a service when "connect" is clicked by way of an OpenVPN configuration file. However, VerSprite was able to create a crafted OpenVPN file which could be sent to the service, loaded, and executed.
Facebook

How Facebook's WhatsApp Destroyed A Village (buzzfeednews.com) 229

The proliferation of affordable smartphones, dwindling data prices, and apps and services that are designed to work swiftly on such patchy infrastructure have changed how people in developing markets marred with poor literacy level such as India communicate, do business, and get their education. But it has also come at a cost. In the recent months we have learned about Facebook's struggle to contain violence in Myanmar, BuzzFeed News has a chilling story on how rumors circulated through WhatsApp, which is also owned by Facebook, are causing real violence in India, the world's second largest internet market. From the report: WhatsApp, a Facebook-owned messaging service, is used by more than 200 million people in India, its largest market. It's become an inextricable part of the country's culture and social fabric, widely used by younger and older generations alike. It's one of Facebook CEO Mark Zuckerberg's crown jewels, an app he acquired for $19 billion in 2014 that began as a messaging platform but is now evolving into something more, with a new payments feature already being tested in India.

Lately, however, WhatsApp has been getting Indians killed. In June, rumors about child kidnappers shared on the service inspired a mob of hundreds to lynch a 29-year-old man and his friend who were passing through a village in Karbi Anglong, a district in the eastern part of the country. In July, two weeks after the Rainpada incident, hundreds of people hurled stones at an IT worker who was visiting the South Indian village of Murki, killing him. Since May, there have been at least 16 lynchings leading to 29 deaths in India where public officials say mobs were incited by misinformation on WhatsApp. As Facebook wrangles an ongoing crisis of public confidence over its role in spreading misinformation throughout the 2016 US presidential election, the company is grappling with a different kind of problem in places like Rainpada, where its products have abetted flesh-and-blood harm. In attempting to fulfill Facebook's current mission -- to "give people the power to build community and bring the world closer together" -- Zuckerberg and his team of Silicon Valley-based executives failed to foresee its malignant applications: misinformation, propaganda, rumor, hate.

Technology

The 'Post-PC Era' Never Really Happened... and Likely Won't (techpinions.com) 218

Mark Lowenstein, writing for Techpinions: As we head toward Apple's annual device announcement-palooza, it's an interesting exercise to consider where we are in Steve Jobs' vaunted, much quoted 'Post-PC Era.' The fact of the matter is, that era never fully arrived, and it doesn't look like it will, in the near- to medium- term future. [...] Tablets have had a good run, but sales have tailed off of late. I'd say they've had greater influence on the evolution of the smartphone and the PC, rather than leading to a significantly different nomenclature for what most of us carry around today. My Techpinions colleague Ben Bajarin says that Creative Strategies surveys indicate that only about 10% of tablet users have 'replaced their PC' -- a number that has held steady for several years. And that 10% is concentrated in a handful of industries, such as real estate and construction. PC sales aren't exactly surging, but they're steady. Your average white collar professional today still carries around a smartphone and a laptop, with the tablet being an ancillary device, used primarily for media/content consumption.

Tablets have had a significant influence on the design of smartphones and PCs. They ushered in an era of smartphone screen upsizing, led primarily by Samsung, and now reinforced by the iPhone X and the expected announcement next week of a 6.5 inch iPhone model. For those who don't want to swing both a smartphone and tablet, we have 'Phablets,' most personified in the successful Galaxy Note series, and alternative-to-keyboard input devices such as the S Pen and the Apple Pencil. We've also seen the development of some hybrid tablet/PC devices, the most innovative and successful of which is Microsoft's Surface line. But that product is competing more in the tablet category than in the PC category, with the exception of a few market segments.

Earth

Giant Trap Is Deployed To Catch Plastic Littering the Pacific Ocean (nytimes.com) 227

A nonprofit has deployed a multimillion-dollar floating boom designed to corral plastic debris littering the Pacific Ocean (Warning: source may be paywalled; alternative source). The 2,000-foot-long structure left San Francisco Bay on Saturday. According to The New York Times, Ocean Cleanup "aims to trap up to 150,000 pounds of plastic during the boom's first year at sea." From the report: Within five years, with the creation of dozens more booms, the organization hopes to clean half of the Great Pacific Garbage Patch. Over the next several days, the boom will be towed to a site where it will undergo two weeks of testing. If everything goes as planned, the boom will then be brought to the garbage patch, nearly 1,400 miles offshore, where it is expected to arrive by mid-October, said Boyan Slat, 24, the Dutch inventor and entrepreneur who founded Ocean Cleanup.

The cleanup system is supposed to work like this: After the boom detaches from the towing vessel, the current is expected to pull it into the shape of a "U." As it drifts along, propelled by the wind and waves, it should trap plastic "like Pac-Man," the foundation said on its website. The captured plastic would then be transported back to land, sorted and recycled. The boom has an impenetrable skirt that hangs nearly 10 feet below to catch smaller pieces of plastic. The nonprofit said marine life would be able to pass underneath.

Encryption

Worries Arise About Security of New WebAuthn Protocol (zdnet.com) 57

An anonymous reader writes: "A team of security researchers has raised the alarm about some cryptography-related issues with the newly released WebAuthn passwordless authentication protocol," reports ZDNet. "The new WebAuthn protocol will allow users of a device -- such as a computer or a smartphone -- to authenticate on a website using a USB security key, a biometric solution, or his computer or smartphone's password." But researchers say that because WebAuthn uses weak algorithms for the operations of registering a new device, they can pull off some attacks against it.

"If converted into a practical exploit, the ECDAA attacks discussed in the article would allow attackers to steal the key from a [server's] TPM, which would allow attackers to effectively clone the user's hardware security token remotely," Arciszewski, one of the researchers, told ZDNet. "The scenarios that follow depend on how much trust was placed into the hardware security token," he added. "At minimum, I imagine it would enable 2FA bypasses and re-enable phishing attacks. However, if companies elected to use hardware security tokens to obviate passwords, it would allow direct user impersonation by attackers." Attacks aren't practical, and experts say the root cause relies in badly written documentation that may fool some implementers into supporting the old algorithms instead of newer and more solid ones. The FIDO Alliance was notified and has started work on updating its docs so it won't look like it's recommending ECDAA or RSASSA-PKCS1-v1_5. "PKCS1v1.5 is bad. The exploits are almost old enough to legally drink alcohol in the United States," Arciszewski said.

Iphone

Apple Recalls a Number of iPhone 8 Devices For Manufacturing Defect (digitaltrends.com) 79

Apple is recalling a "small percentage" of iPhone 8 devices due to an issue with the logic board. The affected devices may suddenly freeze or restart -- symptoms that may show up at any time. Digital Trends reports: Apple has launched a repair program for the iPhone 8, and whether your device is exhibiting issues or not, it may be a part of the recall. It's important to note that only iPhone 8 models are being recalled here -- the iPhone 8 Plus seems to have sidestepped the issue completely. Specifically, it seems like some iPhone 8 models manufactured between September 2017 and March 2018, and sold in the U.S., New Zealand, Australia, China, India, and Japan, are affected by the issue. If you bought your phone during that time and in one of those regions, you may well be affected. If you have an iPhone 8, you can copy and paste the serial number in Apple's iPhone 8 checker tool. There are a few ways to get your device fixed if it is affected. "First, you could go to an Apple Authorized Service Provider -- you can find one here," reports Digital Trends. "Second, you could go straight to an Apple Store. Last but not least, you could contact Apple Support, and they'll send you a prepaid shipping box for you to send in your iPhone for repair."
Mozilla

Mozilla Working On Google Translate Integration In Firefox (ghacks.net) 51

Back in 2014, Mozilla partnered with Bing to translate webpages via Firefox in a similar fashion to Chrome's implementation of Google Translate. The company also added support for Yandex Translate in Firefox 41 in mid-2015, but it went all dark soon after and very few updates were issued. Now, Mozilla is finally starting to add support for Google Translate to the translation engine built into Firefox. gHacks reports: While the feature is not fully functional yet, it is an indicator that Mozilla has not forgotten the translate feature completely. Users who enable the translate functionality in Firefox on about:config will notice that Google is the selected translation engine. Google Translate cannot be used currently in Firefox; the browser throws an error message when you hit the translate button in the UI. Bing and Yandex don't seem to work either at this point in time even though Firefox seems to try and translate the page. The "there has been an error translating this page" error is thrown eventually as well. Google Translate requires API access keys and that is usually only available if companies or users pay for the key. It is unclear if Mozilla plans to make a deal with Google or if users will be required to use their own API keys for the functionality. The latter would surely be very limiting.
Earth

An Autonomous Sailboat Successfully Crosses Atlantic Ocean (digitaltrends.com) 59

An anonymous reader quotes a report from Digital Trends: The first unmanned and autonomous sailboat has successfully crossed the Atlantic Ocean, completing the journey between Newfoundland, Canada, and Ireland. The 1,800 mile journey took two and a half months. It was part of the Microtransat Challenge for robotic boats, and bolsters the possibility of unmanned boats being used for long-haul missions. This could include everything from ocean research to surveillance. "This has never been done before," David Peddie, CEO of Norwegian-based Offshore Sensing AS, which built the vessel, told Digital Trends. "The Sailbuoy [robotic boat] crossed this distance all by itself without incident. The significance of this is that it proves that one can use unmanned surface vehicles to explore the oceans for extended periods and distance. This greatly reduces the cost of exploring the oceans, and therefore enables a much more detailed knowledge of the oceans than is possible using conventional manned technology."

According to Peddie, the journey was surprisingly uneventful when it came to dealing with major challenges. That's a significant departure from the 20 previous unsuccessful efforts made by teams trying to complete the challenge since it started in 2010. "We had to wait a while for the right wind conditions to deploy safely; otherwise, the crossing has been normal with not too much wind and waves," he said. "We had to avoid some oil platforms, but this is not unusual since we test in the North Sea." He also noted that an effort was made to stay away from other ships, since there was a risk that the boat may have been picked up by passing traffic. Sailbuoy ships cost $175,000 each and are powered by on-board solar panels. They send constant GPS data to reveal exactly where they are located.

Slashdot Top Deals