Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror

Submission + - Old Apache Code at Root of Android FakeID Mess (securityledger.com)

Submitted by chicksdaddy
chicksdaddy writes: The Security Ledger reports that a four year-old vulnerability in an open source component that is a critical part of Android mobile OS leaves hundreds of millions of mobile devices susceptible silent malware infections. (https://securityledger.com/2014/07/old-apache-code-at-root-of-android-fakeid-mess/)

The vulnerability was disclosed on Tuesday (http://bluebox.com/news/). It affects devices running Android versions 2.1 to 4.4 (“KitKat”), according to a statement released by Bluebox. According to Bluebox, the vulnerability was found in a package installer in affected versions of Android. The installer doesn't attempt to determine the authenticity of certificate chains that are used to vouch for new digital identity certificates. In short, Bluebox writes “an identity can claim to be issued by another identity, and the Android cryptographic code will not verify the claim.”

The security implications of this are vast. Malicious actors could create a malicious mobile application with a digital identity certificate that claims to be issued by Adobe Systems. Once installed, vulnerable versions of Android will treat the application as if it was actually signed by Adobe and give it access to local resources, like the special webview plugin privilege, that can be used to sidestep security controls and virtual ‘sandbox’ environments that keep malicious programs from accessing sensitive data and other applications running on the Android device.

In a scenario that is becoming all too common: the flaw appears to have been introduced to Android through an open source component — this time from Apache Harmony (http://harmony.apache.org/), an open source alternative to Oracle’s Java. Google turned to Harmony as an alternative means of supporting Java in the absence of a deal with Oracle to license Java directly.

Work on Harmony was discontinued in November, 2011. However, Google has continued using native Android libraries that are based on Harmony code. The vulnerability concerning certificate validation in the package installer module persisted even as the two codebases diverged.

Submission + - 35% of (American) Adults Have Debt "In Collections" 1

Submitted by meeotch
meeotch writes: According to a new study by the Urban Institute, 35% of U.S. adults with a credit history (91% of the adult population of the U.S.) have debt "in collections" — a status generally not acquired until payments are at least 180 days past due. Debt problems seem to be worse in the South, with states hovering in the 40%+ range, while the Northeast has it better, at less than 30%. The study's authors claim their findings actually underrepresent low-income consumers, because "adults without a credit file are more likely to be financially disadvantaged."

Oddly, only 5% of adults have debt 30-180 days past due. This latter fact is partially accounted for by the fact that a broader range of debt can enter "in collections" status than "past due" status (e.g. parking tickets)... But also perhaps demonstrates that as one falls far enough along the debt spiral, escape becomes impossible. Particularly in the case of high-interest debt such as credit cards — the issuers of which cluster in states such as South Dakota, following a 1978 Supreme Court ruling that found that states' usury laws did not apply to banks headquartered in other states.

Even taking into account the folks to lost a parking ticket under their passenger seat, 35% is a pretty shocking number. Anyone have other theories why this number is so much higher than the 5% of people who are just "late"? How about some napkin math on the debt spiral? (And unfortunately, cue the inevitable geek snobbery about how people in debt must be "idiots".)

Submission + - Amputee is German long jump champion

Submitted by hweimer
hweimer writes: German long jumper Markus Rehm has written sports history yesterday, becoming the first disabled athlete to win a national able-bodied championship. His jump to 8.24 meters put him on the 9th place of the current season rankings and make him egligible to compete in the upcoming European championships, further sparking the debate whether his prosthetic leg provides him with an unfair advantage.

Feed Google News Sci Tech: Tim Cook, Making Apple His Own - New York Times (google.com)

From feed by feedfeeder

New York Times
Tim Cook, Making Apple His Own
New York Times
Tim Cook, Apple's chief executive, was an adolescent boy in a small Alabama town in the early 1970s when he saw something he couldn't forget. Bicycling home on a new 10-speed, he passed a large cross in flames in front of a house — one that he knew...
Jony Ive on Tim Cook's Apple: Nothing has changedCNET
Apple's CEO Tim Cook: An Alabama day that forever changed his lifeal.com
The iPad mini Steve Jobs didn't want was Tim Cook's doing, report claimsTechRadar UK
Business Insider-TechnoBuffalo
all 22 news articles

Comment Re:not just obsessive collectors (Score 1) 116

by MoldyZero (#47218163) Attached to: Physical Media: Down, But Maybe Not Out

So, you're saying that the quiet, massive majority has tons of disposable income to purchase the same thing multiple times? I must say, I have a hard time believing that.

I don't know where you live, but where I live, people don't have tons of money to throw around. When they purchase something, they purchase the tangible goods, because they want to know that the item(s) they have purchased is *theirs*. As an example, one of my neighbors is a huge bookworm, but she will only purchase physical books. She torrents the ebook versions to store on her Nook for when she goes on vacation and doesn't have the luggage space for the physical books.

Submission + - The Government Can No Longer Track Your Cell Phone Without a Warrant 1

Submitted by Jason Koebler
Jason Koebler writes: The government cannot use cell phone location data as evidence in a criminal proceeding without first obtaining a warrant, an appeals court ruled today, in one of the most important privacy decisions in recent memory.
"In short, we hold that cell site location information is within the subscriber’s reasonable expectation of privacy," the United States Court of Appeals for the Eleventh Circuit ruled. "The obtaining of that data without a warrant is a Fourth Amendment violation."

Submission + - Physical Media: Down, But Maybe Not Out (itworld.com)

Submitted by jfruh
jfruh writes: For many tech-savvy folks, it may come as surprise that physical media like DVD and Blu-Ray still generate more movie revenue than streaming services. But PriceWaterhouse Coopers is predicting that the the lines will cross in 2017 as physical media sales and rentals decline; already, fully half of those reveneues come from supermarket Redbox kiosks. Still, there are signs that physical media won't vanish entirely, including the obsessive needs of collectors and the music industry's increasing suspicions of digital sales.

Comment As someone directly involved... (Score 4, Insightful) 98

by Kris Warkentin (#46325165) Attached to: Why Copyright Trolling In Canada Doesn't Pay

Apparently I'm actually one of the IP addresses named in the original suit. Funny thing is, I don't know, nor have I downloaded any of Voltage's list of crappy films. They actually have 'The Hurt Locker' (which I haven't seen) in their list but the rest are pretty much B movies. What's even more funny is that the time during which I was alleged to have downloaded some of their stuff was the same time I was in Europe on a two week vacation. There were people looking in on our house and we also have neighbors and such who use our wifi so certainly others might have downloaded movies but not me.

A fun fact about Canadian jurisprudence is that typically the loser pays court costs so if they DO try to take me to court, I think I might exhaust ever single possible legal argument, drag the whole thing out as long as I can before dropping that bombshell. I'm pretty sure that being on the other side of the Atlantic in the middle of the Adriatic on a cruise ship with no internet access proves that I didn't download anything... If I can cost Voltage a fortune in legal fees then it will be a good day.

Slashdot Top Deals

"The great question... which I have not been able to answer... is, `What does woman want?'" -- Sigmund Freud

Close