Snapdragon chip flaws put >1 billion Android phones at risk of data theft

There’s no word on when Google and phone makers will incorporate fix from Qualcomm.

Stylized promotional image of a Qualcomm computer chip.

Enlarge (credit: Qualcomm)

A billion or more Android devices are vulnerable to hacks that can turn them into spying tools by exploiting more than 400 vulnerabilities in Qualcomm’s Snapdragon chip, researchers reported this week.

The vulnerabilities can be exploited when a target downloads a video or other content that’s rendered by the chip. Targets can also be attacked by installing malicious apps that require no permissions at all.

From there, attackers can monitor locations and listen to nearby audio in real time and exfiltrate photos and videos. Exploits also make it possible to render the phone completely unresponsive. Infections can be hidden from the operating system in a way that makes disinfecting difficult.

Read 7 remaining paragraphs | Comments

Google Meet shortcuts added to Gmail app for Android (Here’s how to disable it)

Video communication tools have become more important than ever during the global COVID-19 pandemic. Zoom has exploded in popularity. Facebook, Google, and Microsoft have added new features to their video chat and video conferencing tools. And Google d…

Video communication tools have become more important than ever during the global COVID-19 pandemic. Zoom has exploded in popularity. Facebook, Google, and Microsoft have added new features to their video chat and video conferencing tools. And Google decided to add Google Meet shortcuts to the Gmail app for Android so you won’t forget that Google […]

The post Google Meet shortcuts added to Gmail app for Android (Here’s how to disable it) appeared first on Liliputing.

Science, history, and purring cats: Brief podcasts for the nerdy set

In at least one podcast’s case, put your phone on your chest, hit play, and unwind.

Podcasts with your interests—and attention span—in mind.

Enlarge / Podcasts with your interests—and attention span—in mind. (credit: Aurich Lawson / Getty Images)

The beauty of the podcast format is also sometimes its curse: arbitrary episode lengths. Finding a new podcast to love can be daunting when episodes regularly exceed the hour-long mark. If you’re struggling to commit to podcasts on topics like history and science, don’t fret: We have recommendations for great series that typically serve complete episodes well under half an hour.

Science Diction

Sometimes the best way to recover from stress is to focus on learning something new. Science Diction helps with this by presenting the etymologies of familiar scientific technical terms alongside bite-sized usage histories of how people engage with science. The episode on "Meme," for example, tells the story of the word's coinage as a parallel to "gene" to show how ideas spread through a culture. Science Diction talks about the spread of "meme" itself, sometimes as a meme, until it became the one of the most common ways to refer to images and jokes passed around on the Internet. An episode titled "Vaccine," meanwhile, teaches us what happens when the public is scared of new science, describing antivax propaganda nearly as old as the first vaccines themselves.

Science Diction releases episodes monthly, and it only started this year, so many of its episodes are about concepts related to COVID-19. Even if you’re fatigued by that topic, I still recommend this podcast as a refreshing, historical overview of similar stories, told in a laid-back way.

Read 8 remaining paragraphs | Comments

COVID-19 won’t impact climate much, but economic recovery could

Pollution reductions too short-lived, but where do we want to go after?

India saw a notable decline in aerosol pollution in April.

Enlarge / India saw a notable decline in aerosol pollution in April. (credit: NASA EO)

Given the radical changes people have undertaken to limit the spread of COVID-19 (hello month six of quarantine-except-for-groceries), many have naturally wondered what impact this has had on pollution, including greenhouse gases and climate change. Some short-lived pollutants dropped noticeably during the strong lockdowns of April, as businesses shuttered and travel was reduced. But CO2 levels don't fluctuate based on short-term events like that, so the long-term effect on climate change was expected to be trivially small—assuming economies rebounded fairly quickly.

A new study led by the University of Leeds’ Piers Forster (and his daughter Harriet) takes advantage of phone location data to re-examine the first six months of the year, tracking more than just CO2. While they ultimately find that the impact has been small, their results also highlight that the way economies choose to rebound could have a much bigger effect over the long term.

The work relies on mobility data made public by Google and Apple, covering 114 countries. Using that along with energy and emissions datasets, the researchers converted behavior changes into pollution changes. The phone data record changes in transportation use quite well, although purported changes in activity between residential, commercial, and industrial settings are harder to relate to energy. The researchers compared the changes they saw in their phone data to a May study that estimated April emissions using things like utility data. They found their phone-based estimate of home energy use probably overestimates the real change.

Read 10 remaining paragraphs | Comments

Eingelöteter Speicher: Neuer iMac ohne SSD-Aufrüstmöglichkeiten

Der neue iMac kann nicht mehr mit SSDs aufgerüstet werden – bei den günstigeren Varianten wurde die Möglichkeit gestrichen, bei den teureren ist sie fraglich. (iMac, Apple)

Der neue iMac kann nicht mehr mit SSDs aufgerüstet werden - bei den günstigeren Varianten wurde die Möglichkeit gestrichen, bei den teureren ist sie fraglich. (iMac, Apple)

The quest to liberate $300,000 of bitcoin from an old ZIP file

A few quintillion possible decryption keys stand between a man and his cryptocurrency.

The quest to liberate $300,000 of bitcoin from an old ZIP file

Enlarge (credit: Getty Images)

In October, Michael Stay got a weird message on LinkedIn. A total stranger had lost access to his bitcoin private keys—and wanted Stay's help getting his $300,000 back.

It wasn't a total surprise that The Guy, as Stay calls him, had found the former Google security engineer. Nineteen years ago, Stay published a paper detailing a technique for breaking into encrypted zip files. The Guy had bought around $10,000 worth of bitcoin in January 2016, well before the boom. He had encrypted the private keys in a zip file and had forgotten the password. He was hoping Stay could help him break in.

In a talk at the Defcon security conference this week, Stay details the epic attempt that ensued.

Read 18 remaining paragraphs | Comments

Disney Reminds Court That Pirate Megavideo Indexing Site Still Owes $500K from 2010

When pirate sites agree to settle lawsuits, these cases tend to disappear into the night. However, when stream-linking site 66Stage agreed to pay Disney $500K in 2010 for linking to pirated movies on Megavideo and other sites, the movie company expected to get paid. A decade on, it appears that Disney has a very long memory.

From: TF, for the latest news on copyright battles, piracy and more.

Disney PirateEvery year, movie and TV show companies, broadcasters, and other rightsholders take legal action against pirate sites.

This action can take various forms, from threats that result in private settlement agreements to full-blown lawsuits.

In some cases, litigation can drag on for years, with a tendency to prove both costly and damaging to those who lose the fight. In most cases, these are the operators of unlicensed sites who initially put up a fight before being overwhelmed with costs and subsequent damages awards.

Another option, when it’s available, is to settle cases with the plaintiffs relatively early on. This is what happened in a lawsuit filed by Disney Enterprises and Universal City Studios against indexing site 66Stage.com back in 2008.

66Stage was a One-Stop-Shop For Piracy

Filed in a California court, the complaint described 66Stage as a “for-profit ‘one-stop-shop'” for infringing copies of the plaintiffs’ movies including Finding Nemo, Mulan, Pirates of the Caribbean: At World’s End and several others.

“Defendants own and operate the website www.66stage.com…whose purpose is to promote, facilitate, aid and abet, and profit from the infringement of Plaintiffs’ copyrighted works,” the complaint alleged.

“Specifically, Defendants post, organize, search for, identify collect and index links to infringing material that is available on third-party websites (including, for example, the third party website Megavideo.com).”

As this image from the Wayback Machine’s archives shows, 66Stage acted as a front-end to hosting sites like Megavideo, which was later dismantled as part of the Megaupload raids early 2012.

66stage.com

Disney and Universal identified Nasri Faical as the person behind 66Stage, noting that he was a citizen of Morocco who at the time was living in Japan. According to the amended complaint, his site offered thousands of links to hundreds of motion pictures released in 2008 and 2009, with new content being added all the time.

As a result, the plaintiffs alleged contributory copyright infringement and inducement of copyright infringement, plus aiding and abetting copyright infringement under the Copyright Act of Japan. The docket reveals that the case went through the motions until August 2010, at which point it was revealed that the parties had agreed to a consent judgment to settle the case.

$500,000 Settlement Agreement

That agreement didn’t come cheap. Faical agreed to a global injunction preventing him from running 66Stage or any similar site, being involved in any activity that infringed the plaintiffs’ rights, and/or participating in any marketing or advertising program designed to drive traffic or generate revenue from infringement.

With that, Faical agreed to pay Disney and Universal $500,000 in damages for copyright infringement. He also agreed to be bound by the orders of any other court in the world “with competent jurisdiction” to enforce the consent judgment.

66stage consent

Whether this significant debt is still on the mind of Faical is unknown. However, if carefully waiting it out was indeed on his agenda, this week the former site operator would’ve been holding his breath. According to the California courts website, money judgments have an expiry date – 10 years to be precise – and the deadline was this week.

A Decade On and Disney’s Time Was Running Out

“Money judgments automatically expire (run out) after 10 years. To prevent this from happening, you as the judgment creditor must file a request for renewal of the judgment with the court BEFORE the 10 years run out. If the judgment is not renewed, it will not be enforceable any longer and you will not be able to get your money,” it reads.

Given that the consent judgment was signed off by the judge on August 5, 2010, Faical would not have owed Disney a penny if ten years were allowed to pass without the company taking further action. As it happens, however, it Disney’s lawyers were absolutely on the ball.

This week the company filed the necessary paperwork to keep the matter and the substantial debt alive, just a day before Disney would’ve had to wave goodbye to $500K and Faical would’ve been a ‘free’ man again.

“There have been no payments received from any of the Defendants towards the Judgment, through the judgment enforcement process or otherwise. Accordingly, the total amount due to Defendants under the renewed judgment is $500,000.00,” the renewal of money judgment reads.

Like Dumbo, it seems, Disney never forgets.

The original amended complaint, judgment and renewal can be found here (1,2,3 pdf)

From: TF, for the latest news on copyright battles, piracy and more.