Category: Uncategorised

(credit: Josh Koonce)

On Wednesday, the Maryland Court of Special Appeals published a legal opinion finding that state police must not only obtain a warrant before deploying a cell-site simulator, but are required to also fully explain to the court what exactly the device does and how it is used.

As Ars has long reported, cell-site simulators—known colloquially as stingrays, can be used to determine a mobile phone’s location by spoofing a cell tower. In some cases, stingrays can intercept calls and text messages. Once deployed, the devices intercept data from a target phone along with information from other phones within the vicinity. At times, police have falsely claimed the use of a confidential informant when they have actually deployed these particularly sweeping and intrusive surveillance tools.

In recent years, stingray use has come under increasing scrutiny, with several states including California, Washington, Virginia, Minnesota, and Utah now mandating a warrant be issued for their use. Last year, the Department of Homeland Security and the Department of Justice also imposed new policies that require a warrant for stingray use in most cases.

(credit: Aleksander Markin)

The Electronic Frontier Foundation has advocated against ridiculous software patents for more than a decade, but it wasn't until last year that the organization took on a pro bono client accused of patent infringement. A little-used video website called Garfum.com sued Pennsylvania photographer Ruth Taylor, saying she was infringing US Patent No. 8,209,618. Garfum, owned by a New Jersey man named Michael Garofalo, says the patent was infringed by the photo contests Taylor runs on her website, Bytephoto.

Garofalo's lawyers demanded $50,000 from Taylor as a royalty payment. After they discovered that Bytephoto's income in 2014 was less than $500, they asked to see Taylor's tax returns. They dropped their demand to $5,000, and later to $2,500.

Rather than pay, Taylor got in touch with EFF, and the timing was right. Taking on any patent case was a potentially big commitment. Even one that ends quickly can cost hundreds of thousands of dollars, and cases that go to a jury trial can cost millions.

Nintendo's latest high-profile firing resulted in both sides offering different stories about to why it happened. (credit: Nintendo of America)

A Nintendo of America marketing specialist announced her firing from the company on Wednesday—and insinuated that the termination was related to "a whirlwind of controversy and [GamerGate] harassment." However, Nintendo offered a firm rebuttal to that story and confirmed its dedication to inclusive hiring practices.

"Though Ms. Rapp’s termination follows her being the subject of criticism from certain groups via social media several weeks ago, the two are absolutely not related," the company said in a statement issued to press outlets. "Nintendo is a company committed to fostering inclusion and diversity in both our company and the broader video game industry and we firmly reject the harassment of individuals based on gender, race or personal beliefs. We wish Ms. Rapp well in her future endeavors."

Former Game Informer staffer Alison Rapp had worked as a member of Nintendo's "Treehouse" team, which handles various marketing and translation duties, for nearly three years. In February, she found herself in the crosshairs of anonymous Nintendo critics who took issue with Nintendo's localization of recent games, particularly 3DS game Fire Emblem: Fates—which, among other things, removed the Japanese version's "gay conversion" scene.

Roborace

Meet Robocar. It makes F-Zero and Speed Racer seem tame. But couldn't they have come up with a better name?

2 more images in gallery

As we discovered last November, an autonomous car racing series is in the works. Roborace is a partnership between Kinetik (an investment fund that is backing electric vehicle development) and Formula E, the EV racing series that has now entered its third season. Roborace is going to support Formula E next season (starting in late 2016), using identical machinery—each team will write its own algorithms though. This week, Roborace unveiled the first pictures of the AI-controlled cars that will contest the series.

If you think they look like something out of a sci-fi film, you may be on to something. They're the work of Daniel Simon, who in addition to a stint at Bugatti also designed the vehicles in Tron: Legacy and Oblivion.

“My goal was to create a vehicle that takes full advantage of the unusual opportunities of having no driver without ever compromising on beauty. Racing engineers and aerodynamicists have worked with me from the beginning to strike that balance," Simon said. "The Roborace is as much about competition as it is entertainment. Therefore—and quite unusual in today’s racing world—beauty was very high on our agenda and we work hard to merge the best performance with stunning styling."

A slide from Check Point's presentation on "SideStepper" showing a malicious server pushing a fraudulent application to an iOS 9 device--all thanks to MDM hacking and Apple enterprise developer certificates. (credit: Check Point Software Technologies Ltd.)

Security researchers at Check Point Software claim to have found a weakness in Apple's mobile device management (MDM) interface for iOS devices that could be exploited to gain complete access to devices. Dubbed "SideStepper," the approach could allow an attacker to hijack enterprise management functions and bypass Apple's application security.

By sending a link to a victim's device, someone could take control of the MDM software on the phone and push potentially malicious applications to the device as well as perform other configuration changes as a remote administrator. While Apple's security screening for the applications it allows into its App Store is rigorous, there is a backdoor left in the screening process: enterprise app stores. And new research by Check Point being presented at Black Hat Asia 2016 shows that even with security improvements in iOS 9, attackers can kick that backdoor in by hijacking the enterprise management connection.

As long as they've registered with Apple's enterprise developer program to get a software signing certificate, attackers can social engineer victims into consenting to install applications that expose nearly every aspect of their phone's settings and data simply by abusing enterprise policy settings.