An anonymous reader quotes Bleeping Computer: Security researchers have discovered that third-party firmware included with over 2.8 million low-end Android smartphones allows attackers to compromise Over-the-Air (OTA) update operations and execute commands on the target's phone with root privileges. This is the second issue of its kind that came to light this week after researchers from Kryptowire discovered a similar secret backdoor in the firmware of Chinese firm Shanghai Adups Technology Co. Ltd.. This time around, the problem affected Android firmware created by another Chinese company named Ragentek Group.
It apparently affects more than 55 low-end/burner phones from BLU, Infinix Mobility, DOOGEE, LEAGOO, IKU Mobile, Beeline, and XOLO. According to the article, the binary performing the insecure updates "also includes code to hide its presence from the Android OS, along with two other binaries and their processes... Without SSL protection, this OTA system is an open backdoor for anyone looking to take control of it." Even worse, three domains were hard-coded into the binaries, two of which were unregistered, according to the researchers. "If an adversary had noticed this, and registered these two domains, they would've instantly had access to perform arbitrary attacks on almost 3,000,000 devices without the need to perform a Man-in-the-Middle attack."

rift321 writes "VLC media player, which we all know for simplifying the playback of pretty much any codec out there, has finally released version 1.0.0. Here's a quick list of improvements: live recording, instant pausing and frame-by-frame support, finer speed controls, new HD codecs (AES3, Dolby Digital Plus, TrueHD, Blu-Ray Linear PCM, Real Video 3.0 and 4.0), new formats (Raw Dirac, M2TS) and major improvements in many formats, new Dirac encoder and MP3 fixed-point encoder, video scaling in fullscreen, RTSP Trickplay support, zipped file playback, customizable toolbars, easier encoding GUI in Qt interface, better integration in Gtk environments, MTP devices on Linux, and AirTunes streaming."

Anon E. Muss writes "Just because you can put a camera somewhere doesn't mean you should. Apparently, the Department of Homeland Security doesn't grasp this concept. They've installed video cameras in urinals at Houston's Hobby Airport. At least they weren't sneaky about it — they posted a notice saying 'Automatic infrared flush sensors also provide video monitoring for security purposes.' (Insert bad joke about bashful bladder syndrome here)."

gabrlknght writes "An old element just learned a new trick under pressure. When cooled and squeezed very hard, the soft metallic element europium turns into a superconductor, allowing electrons to flow unfettered by resistance, a study appearing May 13 in Physical Review Letters shows. The results make europium the 53rd of the 92 naturally occurring elements to possess superconductivity, which, if harnessed, could make for more efficient energy transfer."

Barence writes "A Google Street View car has been chased out of a British village by angry residents. The car was taking photographs of Broughton in Buckinghamshire for Google's when it was spotted by a local resident who warned the car not to enter the village then roused his neighbors, who surrounded the vehicle until the driver performed a U-turn and left. 'This is an affluent area,' protester Paul Jacobs said. 'We've already had three burglaries locally in the past six weeks. If our houses are plastered all over Google it's an invitation for more criminals to strike. I was determined to make a stand, so I called the police.'"

TheDopp writes "The United Nations hosted the cast and crew of Battlestar Galactica Tuesday evening in New York. Clips of the show were shown as discussion points during the event, touching on the morality of Suicide Bombers in war, Abortion and the use of torture on enemies of the state. At one point during the event an attendee mentions 'the "Old Man" launched into a passionate speech about casting off the idea of race as a cultural determinant, and said we were one race, the human race. His voice echoed throughout the chamber growing louder until — I kid you not — he was yelling, "So Say We All," and the crowd answered right back. Hell, even I yelled it, I was in the fraking United Nations with Adama, the gods themselves could not have stopped this moment.' The full video of the event is located on the UN website."

NewYorkCountryLawyer writes "You may recall that in an RIAA case, SONY BMG Music v. Tenenbaum, the district court ruled that an oral argument about the constitutionality of statutory damages could be streamed, and the RIAA has been fighting that with a petition for 'mandamus or prohibition' in the appeals court, which is opposed by the press. Interestingly, it now turns out that the appeals court's oral argument about the streaming will itself be recorded and then streamed. It is hard to imagine how a court which routinely streams its own oral arguments can rule that it is somehow inappropriate for similar oral arguments in the district court to be streamed as well."

CWmike writes "The fallout from Thursday's arrests of a District of Columbia IT security official and contractor quickly raised questions about the fate of Vivek Kundra, the new federal CIO who until recently ran the office now mired in bribery allegations. Appointed by President Barack Obama as CIO less than two weeks ago, Kundra was CTO for the District of Columbia. But yesterday, Kundra's former office in a downtown government building was a crime scene. A White House official, speaking on background, confirmed today that Kundra took a leave of absence from his new CIO job shortly after federal investigators arrested two men in the DC government office on bribery charges. The official would not elaborate on the reasons for the leave; there were no indications yesterday that Kundra was involved in any wrongdoing. Kundra's decision could slow his plan to create a 'revolution' in the federal government's use of technology."