Marcher Trojan Hits Android Users Through Face Adobe Flash Installer

Found on eWEEK on Monday, 14 March 2016
Browse Internet

Many different vulnerabilities show up in Adobe Flash—in fact, Adobe just released fixes 23 of the latest security flaws this week. But the new Android Marcher Trojan isn't using an authentic version of Flash or exploiting vulnerabilities that Adobe has already patched. Rather, the Android Marcher Trojan uses a fake version of an Adobe Flash Player installer to infect users.

Flash again, really now? That giant black hole should just die.

Florida sheriff says he'll jail 'rascal' Tim Cook

Found on CNet News on Sunday, 13 March 2016
Browse Legal-Issues

"I can tell you, the first time we do have trouble getting into a cell phone, we're going to seek a court order from Apple," he said. "And when they deny us, I'm going to go lock the CEO of Apple up. I'll lock the rascal up."

When once asked why his officers had shot at a suspect 110 times, hitting him 68 times, he explained that it was "all the ammunition they had."

Ain't he a cute little foot stomper? Pretty sure he would jail Cook too if Apple would decrypt a phone to obey a court order in, let's say, Russia; but for treason.

Encrypted WhatsApp messages frustrate new court-ordered wiretap

Found on Ars Technica on Sunday, 13 March 2016
Browse Internet

According to a Saturday report in The New York Times, prosecutors have gone head-to-head with WhatsApp, the messaging app owned by Facebook. Citing anonymous sources, the Times reported that "as recently as this past week," federal officials have been "discussing how to proceed in a continuing criminal investigation in which a federal judge had approved a wiretap, but investigators were stymied by WhatsApp’s encryption."

As Ars reported earlier this month, since late 2014, all WhatsApp messages sent between Android devices are end-to-end encrypted, which means that not even parent company Facebook can access their plaintext contents.

When police et al complain about encryption, it makes you wonder how they dealt with being unable to listen to a conversation back in the days where modern communication did not exist and people just talked to each other, face to face.

Windows 10 Upgrade Reportedly Starting Automatically on Windows 7 PCs

Found on Softpedia on Saturday, 12 March 2016
Browse Software

A post on reddit that has received quite a lot of attention in the last few hours reveals that “Windows 7 computers are being reported as automatically starting the Windows 10 upgrade without permission,” with several users confirming in the comment section that this is indeed the case.

“Depending upon your Windows Update settings, this may cause the upgrade process to automatically initiate on your device. Before the upgrade changes the OS of your device, you will be clearly prompted to choose whether or not to continue,” he said.

How come nobody has sued Microsoft yet? Not only are they misleading users with "updates", but now also enforcing an OS upgrade, wasting thousands of man-hours because users have to get used to the new OS, or keep their admins busy with questions and complains.

Let's Encrypt Free Certificates' Success Challenges SSL/TLS Industry

Found on eWEEK on Friday, 11 March 2016
Browse Internet

The Let's Encrypt certificate service was first announced in November 2014 as an effort to help expand the use and availability of cryptographic security for Websites.

"More encryption is great but the ease of obtaining certificates automatically can be riskier," Bocek said. "We've already seen phishing sites and other attacks use Let's Encrypt certificates."

"We are only issuing certificates with 90 day lifetimes, and that will be the case for the foreseeable future," Aas said. "Dealing with certificates manually is inefficient and error-prone. We want to strongly encourage automation. And if your system is automated then it doesn't really matter how long the certificate lifetimes are."

It may be acceptable for a private blog which is not really important, but anybody else will still prefer certificates issued by a company. "Dealing with certificates manually" is their business and makes sure that e.g. EV certificates (which are used by banks and big companies) are not issued to anybody without doing a background check. Let's Encrypt is no better than any random self-signed certificate; except that the browser does not pop up a warning message.

Windows patch KB 3139929: When a security update is not a security update

Found on InfoWorld on Thursday, 10 March 2016
Browse Software

If Microsoft's documentation is correct, installing Patch Tuesday's KB 3139929 security update for Internet Explorer also installs a new Windows 10 ad-generating routine called KB 3146449.

It's important to note that KB 3146449 is not installed separately. You can't remove it. If you look in your installed updates list, KB 3146449 doesn't appear. Instead, it's baked into the IE security patch KB 3139929. The only way to get rid of the new advertising inside Internet Explorer 11 is to remove the security patch entirely.

Another reminder to keep automatic updates always disabled. It's a pain to see that you have to invest your time to keep adware, spam and nagware off a system when you just want to update it.

Knackered Euro server turns Panasonic smart TVs into dumb TVs

Found on The Register on Wednesday, 09 March 2016
Browse Technology

The TVs phone home across the internet to Pana's backend systems – such as mhc-xpana-eu.myhomescreen.tv – and if they can't reach the machines, the TVs assume the network is down. That totally stuns the TVs' software, and leaves people unable to start up installed apps, we're told.

"They've also cocked the code up, as it assumes if it can't talk to that server that the entire network is unavailable and reports a network error."

Be prepared to hear many many more similar stories when world and dog has to be connected to the Internet.

1,845 Cases Filed For 'Insulting' Turkish President In Just 18 Months

Found on Techdirt on Tuesday, 08 March 2016
Browse Legal-Issues

The stories keep on coming about prosecutions for "insulting" Erdogan. The most insane one started making news a few weeks ago, when a Turkish man filed a complaint against his own wife for apparently insulting Erdogan in their home.

Incredibly, it appears that such complaints, which need to be approved by the Justice Ministry are coming in at a rate of over 1,000 per month.

Dictators do not take insults lightly; and now that the EU needs him, none of the officials will really complain much.

NYPD counter-terrorism chief John Miller calls Apple out for aiding criminals

Found on NY Daily News on Monday, 07 March 2016
Browse Legal-Issues

“You are actually providing aid to the kidnappers, robbers and murderers who have actually been recorded on the telephones in Riker’s Island telling their compatriots on the outside, ‘You gotta get iOS 8. It’s a gift from God,’ — and that’s a quote — ‘because the cops can’t crack it.’”

“Right now Cy Vance, the Manhattan district attorney, has 175 iPhones stacked up in his office that are subject to search warrants, issued by judges, involved in crimes,” Miller fumed.

At first it was only about the terrorist's phone, and the FBI wanted a one time solution to get access to the data; now some random commissioner whines and wants the same one time solution 175 times.

Email inventor Ray Tomlinson dies at 74

Found on TechRepublic on Sunday, 06 March 2016
Browse Internet

Tomlinson was best known for choosing the @ symbol to indicate a message should be sent to a different computer on a network. He also led development of standards for the from, subject, and date fields found in every email message sent today.

News of his death began circulating on a BBN alumni email list tonight. Another networking legend, TCP/IP inventor Vint Cerf, confirmed it via Twitter.

From today on, his email will hard-bounce with "user unknown".