- apple-list - University of Manitoba Mailing Lists

INTEREST: Ransomware comes of computer age
by Wayne Billing 17 Oct '13

17 Oct '13

…from: http://arstechnica.com/security/2013/10/youre-infected-if-you-want-to-see-y… Ransomware comes of age with unbreakable crypto, anonymous payments. by Dan Goodin<http://arstechnica.com/author/dan-goodin/> - Oct 17 2013, 12:06pm CDT [cid:92703777-A750-40B0-A160-CA42788A79E1@cc.umanitoba.ca] Malware that takes computers hostage until users pay a ransom is getting meaner, and thanks to the growing prevalence of Bitcoin and other digital payment systems, it's easier than ever for online crooks to capitalize on these "ransomware" schemes. If this wasn't already abundantly clear, consider the experience of Nic, an Ars reader who fixes PCs for a living and recently helped a client repair the damage inflicted by a particularly nasty title known as CryptoLocker. It started when an end user in the client's accounting department received an e-mail purporting to come from Intuit. Yes, the attached archived zip file with an executable inside should have been a dead giveaway that this message was malicious and was in no way affiliated with Intuit. But accounting employees are used to receiving e-mails from financial companies. When the receiver clicked on it, he saw a white box flash briefly on his screen but didn't notice anything else out of the ordinary. He then locked his computer and attended several meetings. Within a few hours, the company's IT department received word of a corrupt file stored on a network drive that was available to multiple employees, including the one who received the malicious e-mail. A quick investigation soon uncovered other corrupted files, most or all of which had been accessed by the accounting employee. By the time CryptoLocker had run its course, hundreds of gigabytes worth of company data was no longer available. "After reading about the ransomware on reddit earlier this week<http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care_feeding_of_you…>, we guessed [that it was] what we were dealing with, as all the symptoms seemed to be popping up," Nic, who asked that his last name not be published, wrote in an e-mail to Ars. "We went ahead and killed the local network connection on the machine in question and we were immediately presented with a screenshot letting us know exactly what we were dealing with." According to multiple participants in the month-long discussion, CryptoLocker is true to its name. It uses strong cryptography to lock all files that a user has permission to modify, including those on secondary hard drives and network storage systems. Until recently, few antivirus products detected the ransomware until it was too late. By then, victims were presented with a screen like the one displayed on the computer of the accounting employee, which is pictured above. It warns that the files are locked using a 2048-bit version of the RSA cryptographic algorithm<https://en.wikipedia.org/wiki/RSA_(algorithm)> and that the data will be forever lost unless the private key is obtained from the malware operators within three days of the infection. “Nobody and never will be able to restore files” "The server will destroy the key after a time specified in this window," the screen warns, displaying a clock that starts with 72:00:00 and counts down with each passing second. "After that, nobody and never will be able to restore files. To obtain the private key for this computer, which will automatically decrypt files, you need to pay 300 USD / 300 EUR / similar amount in another currency." None of the reddit posters reported any success in breaking the encryption. Several also said they had paid the ransom and received a key that worked as promised. Full backup files belonging to Nic's clients were about a week old at the time that CryptoLocker first took hold of the network. Nic advised them to comply with the demand. The ransomware operators delivered a key, and about 24 hours later, some 400 gigabytes of data was restored. CryptoLocker accepts payment in Bitcoins or through the MoneyPak payment cards, as the following two screenshots illustrate. [cid:48881253-8F25-4753-90C7-D155D1D8BDDE@cc.umanitoba.ca]<http://cdn.arstechnica.net/wp-content/uploads/2013/10/BitCoin.jpg> Enlarge<http://cdn.arstechnica.net/wp-content/uploads/2013/10/BitCoin.jpg> [cid:38D78380-3DF8-4986-8D67-F5BED90658FF@cc.umanitoba.ca]<http://cdn.arstechnica.net/wp-content/uploads/2013/10/MoneyBank.jpg> Enlarge<http://cdn.arstechnica.net/wp-content/uploads/2013/10/MoneyBank.jpg> The outcome hasn't been as happy for other CryptoLocker victims. Whitehats who tracked the ransomware eventually took down some of the command and control servers that the operators relied on. As a result, people on reddit reported, some victims who paid the ransom were unable to receive the unique key needed to unlock files on their computer. The inability to undo the damage hit some victims particularly hard. Because CryptoLocker encrypted all files that an infected computer had access to, the ransomware in many cases locked the contents of backup disks that were expected to be relied upon in the event that the main disks failed. (The threat is a graphic example of the importance of "cold," or offline backup, a backup arrangement that prevents data from being inadvertently overwritten.) Several people have reported that the 72-hour deadline is real and that the only way it can be extended is by setting a computer's BIOS clock back in time. Once the clock runs out, the malware uninstalls itself. Reinfecting a machine does nothing to bring back the timer or restore the old encrypted session. Earlier this year, researchers from Symantec who infiltrated the servers of one ransomware syndicate conservatively estimated that its operators were easily able to clear $5 million per year<http://arstechnica.com/security/2012/11/mushrooming-growth-of-ransomware-ex…>. No wonder CryptoLocker has had such a long run. As of last week, more than three weeks after it was first published, the reddit thread was still generating five to 10 new posts per day. Also a testament to the prevalence and staying power of CryptoLocker, researchers from security firms TrendMicro and Emsisoft provided technical analyses here<http://blog.trendmicro.com/trendlabs-security-intelligence/threat-refinemen…> and here<http://www.kernelmode.info/forum/viewtopic.php?f=16&t=2945>. "This bug is super scary and could really wipe the floor with lots of small businesses that don't have the best backup practices," Nic observed. "Given the easy money available to scam operators, it's not hard to see why."

1 0

INTEREST: Foxconn admits to pushing interns into overtime to build PS4 parts
by Wayne Billing 17 Oct '13

17 Oct '13

…from: http://arstechnica.com/gaming/2013/10/foxconn-admits-to-pushing-interns-int… Foxconn admits to pushing interns into overtime to build PS4 parts Chinese manufacturer says factory is now in "full compliance" with regulations. by Kyle Orland<http://arstechnica.com/author/kyle-orland/> - Oct 10 2013, 9:21am CDT Controversial Chinese component maker Foxconn has admitted that student interns were assigned to work overtime in order to make parts for Sony's PlayStation 4, in violation of the company's policies. Reports emerged yesterday from Chinese site Tencent Games<http://games.qq.com/a/20131009/015913.htm> (translated by Games in Asia<http://www.gamesinasia.com/report-foxconn-using-forced-student-labor-to-bui…>) that thousands of students from the Xi’an Institute of Technology were forced to work at the Foxconn plant in order to receive six course credits necessary for them to graduate. Once at the plant, the students were reportedly put into menial assembly line jobs rather than anything related to their fields of study. According to the reports, they were forced to work long hours, including night shifts and overtime. In a statement obtained by news site Quartz<http://qz.com/133950/your-playstation-4-may-be-built-by-chinese-students-in…>, Foxconn said that “immediate actions have been taken to bring that campus into full compliance with our code and policies" and that the company is "reinforcing the policies of no overtime and no night shifts for student interns." Foxconn stressed, however, that the interns' work was voluntary and that they could "terminate their participation in the program at any time." The course credit requirement appears to belie that claim, however. Sony, for its part, told gaming industry news site MCV<http://www.mcvuk.com/news/read/forced-student-labour-used-to-build-ps4s-at-…> that it had found Foxconn to be in full compliance with the Sony Supplier Code of Conduct<http://www.sony.net/SonyInfo/csr_report/sourcing/supplychain/supplier.pdf>, meaning it was “complying with all applicable laws, work ethics, labor conditions, and respect for human rights, environmental conservation, and health and safety." Foxconn has long<http://arstechnica.com/apple/2006/06/4461/> faced<http://arstechnica.com/apple/2006/06/4395/> accusations of substandard labor practices<http://arstechnica.com/gadgets/2012/10/internal-investigation-underage-work…> and worker abuse<http://arstechnica.com/gadgets/2010/10/leaked-foxconn-report-details-suppos…> and has been the scene of worker riots<http://arstechnica.com/apple/2012/09/foxconn-worker-riot-closes-factory/>. Last May, Apple reportedly joined with Foxconn<http://arstechnica.com/apple/2012/05/foxconn-and-apple-to-split-costs-to-im…> in paying the costs needed to improve conditions at the factory.

1 0

INTEREST: Guilford County Schools [ASUS] tablet program on hold pending Gorilla Glass
by Wayne Billing 15 Oct '13

15 Oct '13

….from: http://www.charlotteobserver.com/2013/10/13/4385582/guilford-county-schools… Guilford County Schools tablet program on hold The Associated Press Posted: Sunday, Oct. 13, 2013 GREENSBORO, N.C. Guilford County Schools' goal to get tablet computers to every one of its 15,000 students is on hold after students reported melted chargers and a 10 percent rate of broken screens. The system decided earlier this month to shelve the tablets and delay the $3.2 million program until officials can work out the problem with Amplify, a New York-based education technology company that provides the tablets. The students had the tablets for about six weeks. "It may take a while for us to get tablets back, which is of course disappointing. But when we do this again, we want to make sure we do it right," Guilford County Board of Education Chairman Alan Duncan told the News & Record of Greensboro (http://bit.ly/168OPGc). One immediate problem that must be fixed is the failure to put more durable glass in the tables. The school district paid extra for a kind of glass called Gorilla Glass, but the tablets were given regular glass, Amplify spokesman Justin Hamilton said. Amplify buys the tablets from Taiwan-based Asus and is trying to determine why its instructions were not followed, Hamilton said. Guilford County Schools have reported about 10 percent of the tablets had broken glass, compared to about 2 percent in other districts Amplify has worked with before, Hamilton said. The school board is reviewing its decision to buy the tablets from Amplify. The company had the lowest bid of $199 a tablet, which included a built-in platform teachers can use for lessons and to get students involved with each other. The Amplify bid was picked over other offers from companies like Apple, Lenovo, Dell, HP and Samsung. Board member Darlene Garrett, who cast the lone no vote against the Amplify deal, said less than two weeks after the vote the board should have had more information. "We should have asked for it," she said. "But I think we were in a rush to approve it." Read more here: http://www.charlotteobserver.com/2013/10/13/4385582/guilford-county-schools… Wayne Billing Classroom Technology Support Audio Visual and Classroom Technology Support 130 Machray Hall Building 204-474-6649 204-807-3153 (cell) 204-474-7625 (fax) Wayne_Billing(a)umanitoba.ca<mailto:Wayne_Billing@umanitoba.ca>

1 0

FYI: Google sets plan to sell users’ endorsements
by Wayne Billing 12 Oct '13

12 Oct '13

….from: http://thechronicleherald.ca/world/1160337-google-sets-plan-to-sell-users-e… Google sets plan to sell users’ endorsements October 12, 2013 - 10:04am Share on facebook<http://thechronicleherald.ca/world/1160337-google-sets-plan-to-sell-users-e…>Share on twitter<http://thechronicleherald.ca/world/1160337-google-sets-plan-to-sell-users-e…>Share on linkedin<http://www.addthis.com/bookmark.php?v=300&winname=addthis&pub=chjhurst&sour…>More Sharing Services<http://thechronicleherald.ca/world/1160337-google-sets-plan-to-sell-users-e…> Share on email<http://thechronicleherald.ca/world/1160337-google-sets-plan-to-sell-users-e…> Share on prin<http://thechronicleherald.ca/world/1160337-google-sets-plan-to-sell-users-e…> SAN FRANCISCO — Google, following in Facebook’s footsteps, wants to sell users’ endorsements to marketers to help them hawk their wares. On Friday, Google announced an update to its terms of service that allows the company to include adult users’ names, photos and comments in ads shown across the web, based on ratings, reviews and posts they have made on Google Plus and other Google services like YouTube. When the new ad policy goes live Nov. 11, Google will be able to show what the company calls shared endorsements on Google sites and across the web, on the more than 2 million sites in Google’s display advertising network, which are viewed by an estimated 1 billion people. If a user follows a bakery on Google Plus or gives an album four stars on the Google Play music service, for instance, that person’s name, photo and endorsement could show up in ads for that bakery or album. Google said it would give users the chance to opt out of being included in the new endorsements, and people younger than 18 will automatically be excluded. Such product endorsements, especially coming from friends and acquaintances, are a powerful lure to brands, replicating word-of-mouth marketing on a broad scale. But as Facebook has learned, many users have strong and skeptical feelings about their endorsements being used in ads without their explicit permission. “The trick to any advertising like this is to avoid coming across as creepy to your user base and have them say, 'I didn’t want anyone else to know that,'?” said Zachary Reiss-Davis, a Forrester analyst, speaking generally about social ads. In a notice to users posted on its site Friday, Google said, “Feedback from people you know can save you time and improve results for you and your friends across all Google services.” Facebook, the world’s largest social network with 1.2 billion users worldwide, has been aggressively marketing such social endorsements. For example, if you post that you love McDonald’s new Mighty Wings on the chain’s Facebook page, McDonald’s could pay Facebook to broadcast your kind words to all your friends, effectively using you as a product endorser. The company declined to specify exactly how it planned to use endorsements in advertising, what the ads would look like or how brands choose whether to include shared endorsements. Facebook does not allow its users to opt out of such ads, which it calls sponsored stories, although users can limit how their actions on the social network are used in some other types of advertising. Google Plus users, on the other hand, will be able to opt out of inclusion in ads on the social network’s settings page. If a Google Plus user has shared comments with a limited set of people, only people in that circle will see the personalized ads. Ratings and reviews on services like Google Plus Local are automatically public and can be used in ads, unless a user opts out of shared endorsements. Google had previously shown Plus 1s, votes of approval similar to Facebook likes, in ads across Google sites and its ad network. Google plans to expand that to include “follows,” comments, ratings, reviews and other interactions. Those who have already elected to opt out of using Plus 1s in ads will automatically be opted out of the expansion. Though 190 million users post on Google Plus and 390 million use the social network indirectly by sharing on other Google sites like YouTube, Google’s variety of services gives it a potentially wider reach. A user’s Google searches or Gmail correspondence, because they are not considered social interactions, would not be used to generate endorsement ads, although the company uses search history and the content of email to display other ads to users. Currently, Google does not have an ad option incorporating more social data that is ready to be used by advertisers, the company said. Instead, the company wants the ability to offer such ads in the future and is notifying users in advance. Although advertising irks some users — even while it helps support free services — social ads have proved particularly contentious. Facebook recently settled a class-action lawsuit that claimed it had not adequately notified users about how it was using endorsements. In late August, it tried to impose a new privacy policy that would have given the company clearer rights to run social ads without a user’s explicit permission. After privacy groups complained, the Federal Trade Commission began an inquiry into the changes, prompting Facebook to suspend the process. Google, which is under the supervision of the FTC for a previous privacy violation and has agreed to privacy audits and fines for privacy misrepresentations, is taking pains to show that it has considered the privacy implications of the new ads. It will notify users of the change with banners on Google’s home page, in search results, in Google Plus notifications and elsewhere. And posts by users who have registered as being younger than 18 will not appear in ads, though their posts can still appear in search results or other places that are not commercial in nature. Shared endorsements are the latest example of the continual push by Google and other web companies to collate in one place the reams of personal information people share online and use it to personalize people’s online experiences. Privacy advocates say companies do not generally get meaningful consent from their users before using such information. “Users reasonably expect that their comments should be used as they intended,” said Marc Rotenberg, executive director of the Electronic Privacy Information Center, which has tangled with numerous Internet companies, most recently Facebook, over the use of personal information in ads. “People don’t typically race around handing their friends leaflets and advertisements.” In Europe, where privacy is considered a personal right, early reaction was skeptical. “What Google intends to do is get everyone involved in their advertising model without necessarily involving citizens in a decision about whether to participate in that model,” Jan Philipp Albrecht, a German member of the European Parliament who is the main sponsor of legislation overhauling and updating the bloc’s privacy standards, said in a telephone interview Friday. Google’s plan for social advertising is “something we will have to react to in our legislation,” said Albrecht, who said he would like EU governments and legislators to reach a final agreement on the complex law by April.

1 0

INTEREST: Paying tax: Apple Good; Google, Facebook not so much
by Wayne Billing 12 Oct '13

12 Oct '13

….from: http://www.forbes.com/sites/robertwood/2013/10/10/sec-clears-apple-taxes-se… http://arstechnica.com/business/2013/10/to-reduce-its-tax-burden-google-exp… http://www.forbes.com/sites/robertwood/2012/12/27/facebook-mirrors-googles-… AXES<http://www.forbes.com/taxes> | 10/10/2013 @ 1:15AM |1,822 views SEC Clears Apple Taxes---SEC Thinks Different Too [Image representing Apple as depicted in CrunchBase]<http://www.crunchbase.com/company/apple> Image via CrunchBase What does it mean that Apple has been cleared? In the SEC’s eyes, Apple accounts for taxes in accordance with generally accepted accounting principles. The vaunted Securities and Exchange Commission has been stirring the pot of Apple’s complex finances for months now. And as TaxProf Paul Caron notes, the SEC approves Apple’s overseas tax strategies<https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&ved…>. The SEC review<http://www.sec.gov/Archives/edgar/data/320193/000000000013032308/filename1.…> was a worry on one level, especially after Senator Carl Levin (D-Mich.) lambasted the tech giant as “the Holy Grail of tax avoidance.” For a company and CEO as cool as Apple and Tim Cook, respectively, this was presumably not a huge worry. The SEC, after all, as not Senator Levin on a tax witch hunt. Now the SEC has closed the book<http://allthingsd.com/20131007/sec-clears-apples-tax-strategy/>, finding that all is well. The SEC even went so far as to write this letter<http://www.sec.gov/Archives/edgar/data/320193/000000000013048900/filename1.…> that it would take no action. Whatever you think of the U.S. tax system and the lengths to which companies go to pay less, the SEC’s action—or lack thereof—clearly makes sense. Sure, the Senate Permanent Investigations Subcommittee’s report on Apple painted a grim picture. But Apple is less aggressive than many others. In his Senate testimony, CEO Tim Cook distanced Apple from tax gimmicks like IP offshoring. . . . To reduce its tax burden, Google expands use of the “Double Irish” New report: Google moved almost $12B through Bermuda shell company. by Cyrus Farivar<http://arstechnica.com/author/cyrus-farivar/> - Oct 11 2013, 1:55pm CDT . . . Facebook Mirrors Google's Offshore Tax Scheme [cid:552C8D2A-6870-45B1-A325-C624B1B041C7@cc.umanitoba.ca]<http://www.forbes.com/sites/robertwood/2012/12/27/facebook-mirrors-googles-…>[cid:4F64A233-8B8B-4C4C-AF68-2C68B5DDC7EF@cc.umanitoba.ca]<http://www.forbes.com/sites/robertwood/2012/12/27/facebook-mirrors-googles-…>[cid:4045C400-394F-4BA2-85BE-1D2C79B9AB18@cc.umanitoba.ca]<http://www.forbes.com/sites/robertwood/2012/12/27/facebook-mirrors-googles-…>[cid:4F64A233-8B8B-4C4C-AF68-2C68B5DDC7EF@cc.umanitoba.ca]<http://www.forbes.com/sites/robertwood/2012/12/27/facebook-mirrors-googles-…>[cid:618D8EDA-0D36-4ECA-8F96-3F6021CD69E8@cc.umanitoba.ca]<http://www.forbes.com/sites/robertwood/2012/12/27/facebook-mirrors-googles-…>[cid:4F64A233-8B8B-4C4C-AF68-2C68B5DDC7EF@cc.umanitoba.ca]<http://www.forbes.com/sites/robertwood/2012/12/27/facebook-mirrors-googles-…> 6 comments, 6 called-out<http://www.forbes.com/sites/robertwood/2012/12/27/facebook-mirrors-googles-…> Comment Now<http://www.forbes.com/sites/robertwood/2012/12/27/facebook-mirrors-googles-…> Follow Comments<http://www.forbes.com/sites/robertwood/2012/12/27/facebook-mirrors-googles-…> [google+ facebook]<http://www.flickr.com/photos/18090920@N07/6160054455> google+ facebook (Photo credit: Sean MacEntee) What is a tax scheme and what’s legitimate tax planning? It may be a question of opinion. Besides, a “scheme” has different connotations in the U.S. and U.K. But however you slice it, Google and Facebook have something in common. Both companies have used a kind of sandwich not for sustenance but for tax minimization. Recent reports state that Facebook flipped more than $700 million to the Cayman Islands last year as part of a “Double Irish” tax reduction strategy. See Facebook Defends its ‘Double Irish’ Tax Reduction Deal<http://www.belfasttelegraph.co.uk/business/business-news/facebook-defends-i…>. Recall that former Zuckerberg pal and co-founder Eduardo Saverin took considerable heat when he exited the U.S. for Singapore. See Expats Face Steep Exit Tax Courtesy Of Facebook<http://www.forbes.com/sites/robertwood/2012/05/18/expats-face-steep-exit-ta…>. Yet Facebook is recently under more fire than Mr. Saverin. See Facebook Paid £2.9m Tax on £840m Profits Made Outside US<http://www.guardian.co.uk/technology/2012/dec/23/facebook-tax-profits-outsi…>. From an outsider’s perspective, it looks like Facebook Funneled Nearly Half a Billion Pounds Into the Cayman Islands Last Year<http://www.businessinsider.com/facebook-funneled-nearly-half-a-billion-poun…>. Yet Facebook’s technique may not be overly aggressive. Big multinational companies can hire tax lawyers to come up with ways to reduce the company’s effective tax rate from 35% to much less. Google reportedly used the Double Irish and the Dutch Sandwich<http://www.bloomberg.com/news/2010-10-21/google-2-4-rate-shows-how-60-billi…>, saving the company billions<http://www.slate.com/id/2291269/> in U.S. taxes. The Double Irish involves forming a pair of Irish companies to turn payments on intellectual property into tax-deductible royalty payments. The U.S. parent company forms a subsidiary in Ireland. The parent signs a contract giving European rights to its intangible property to the new company. In return, the new subsidiary agrees to help market or promote those products in Europe. Thus, all the European income–that previously would have been taxed in the U.S.—is taxed in Ireland instead. Then the Irish company changes its headquarters to Bermuda–a true tax haven. So far, there has been no Irish tax, no Bermuda tax, and no U.S. tax. Finally, the parent forms a second Irish subsidiary that elects to be treated as disregarded under U.S. tax law–by filing a one-page form. The first Irish company (now in Bermuda) can now license company products to the second Irish company for royalties. The net result is one low 12.5% Irish tax compared to 35% in the U.S. Even this tax can be reduced, since the royalties going to the Bermuda company are deductible. Some of these steps may seem circuitous (they are). Tax treaties permit this, yet a deal done directly with Bermuda (and without all the layers) would incur a tax.

1 0

INTEREST: Cloudy with a chance of security breaches at Adobe
by Wayne Billing 03 Oct '13

03 Oct '13

….from: http://9to5mac.com/2013/10/03/adobe-says-data-for-almost-3m-customers-compr… Adobe says almost 3M customers’ information compromised in sophisticated attack<http://9to5mac.com/2013/10/03/adobe-says-data-for-almost-3m-customers-compr…> [adobe-creative-cloud] Adobe’s Chief Security Officer Brad Arkin announced today<http://blogs.adobe.com/conversations/2013/10/important-customer-security-an…> on the company’s blog that “sophisticated attacks” on its network have been discovered and that some customer information was compromised in the process: Cyber attacks are one of the unfortunate realities of doing business today. Given the profile and widespread use of many of our products, Adobe has attracted increasing attention from cyber attackers. Very recently, Adobe’s security team discovered sophisticated attacks on our network, involving the illegal access of customer information as well as source code for numerous Adobe products. We believe these attacks may be related. Arkin says Adobe’s ongoing investigation has found that the attackers have accessed Adobe IDs and encrypted passwords for approximately 2.9 million customers, but that it does “not believe the attackers removed decrypted credit or debit card numbers.” They were, however, able to get their hands on names, encrypted credit or debit card numbers, expiration dates, and customer order information. The company is also investigating an attack that accessed source code for several Adobe products illegally. Adobe is of course working with law enforcement and continuing its investigation, but in the meantime it announced it will be contacting customers, banks, law enforcement, and automatically reseting customer passwords: * As a precaution, we are resetting relevant customer passwords to help prevent unauthorized access to Adobe ID accounts. If your user ID and password were involved, you will receive an email notification from us with information on how to change your password. We also recommend that you change your passwords on any website where you may have used the same user ID and password. * We are in the process of notifying customers whose credit or debit card information we believe to be involved in the incident. If your information was involved, you will receive a notification letter from us with additional information on steps you can take to help protect yourself against potential misuse of personal information about you. Adobe is also offering customers, whose credit or debit card information was involved, the option of enrolling in a one-year complimentary credit monitoring membership where available. * We have notified the banks processing customer payments for Adobe, so that they can work with the payment card companies and card-issuing banks to help protect customers’ accounts. * We have contacted federal law enforcement and are assisting in their investigation.

1 0

INTEREST: Report finds almost all Android OEMs cheat on benchmarks
by Wayne Billing 02 Oct '13

02 Oct '13

….from: Report finds almost all Android OEMs, not just Samsung, cheat on benchmarks<http://9to5mac.com/2013/10/02/report-finds-almost-all-android-oems-not-just…> When Apple SVP Phil Schiller pointed us to a story earlier this week that Samsung was artificially inflating<http://9to5mac.com/2013/10/01/phil-schiller-calls-out-samsungs-note-3-bench…> benchmark scores for its new Galaxy Note 3, many were quick to point out it wasn’t the first time Samsung had been caught engaged in such a practice. The same issue was discovered by AnandTech for the Galaxy S4 back in July, and today the site has an extensive report showing<http://www.anandtech.com/show/7384/state-of-cheating-in-android-benchmarks> that almost every Android smartphone manufacturer is shipping devices that do the same. As pictured in the chart above, that includes the HTC One, HTC One mini, LG G2, Galaxy Tab 10.1, and many others. In fact, the only companies that appear to not be using the method is Apple and Motorola, as well as Google with its Nexus 4 and Nexus 7 devices: We started piecing this data together back in July, and even had conversations with both silicon vendors and OEMs about getting it to stop. With the exception of Apple and Motorola, literally every single OEM we’ve worked with ships (or has shipped) at least one device that runs this silly CPU optimization. It’s possible that older Motorola devices might’ve done the same thing, but none of the newer devices we have on hand exhibited the behavior. It’s a systemic problem that seems to have surfaced over the last two years, and one that extends far beyond Samsung… None of the Nexus do, which is understandable since the optimization isn’t a part of AOSP. This also helps explain why the Nexus 4 performed so slowly when we reviewed it – this mess was going on back then and Google didn’t partake. As noted in the report, the gains that OEMs are experiencing from the inflated scores are probably not worth the press they’ve been receiving. AnandTech points out that most of the inflated scores provide under a 10% increase in GPU and CPU performance benchmarks: The hilarious part of all of this is we’re still talking about small gains in performance. The impact on our CPU tests is 0 – 5%, and somewhere south of 10% on our GPU benchmarks as far as we can tell. I can’t stress enough that it would be far less painful for the OEMs to just stop this nonsense and instead demand better performance/power efficiency from their silicon vendors. You can check out the full report here<http://www.anandtech.com/show/7384/state-of-cheating-in-android-benchmarks>, which offers in-depth analysis on the optimizations it found for several devices across various benchmark tests. [android-benchmarks-cheaters.png]

1 0

FYI: patch to iOS 7
by Wayne Billing 26 Sep '13

26 Sep '13

Some security issues have been found in the original release of iOS7. Apple has just released 7.0.2 to address the problems. Full announcement below. Wayne Billing Classroom Technology Support Audio Visual and Classroom Technology Support 130 Machray Hall Building 204-474-6649 204-807-3153 (cell) 204-474-7625 (fax) Wayne_Billing(a)umanitoba.ca<mailto:Wayne_Billing@umanitoba.ca> Begin forwarded message: From: <security-announce-request(a)lists.apple.com<mailto:security-announce-request@lists.apple.com>> Subject: Security-announce Digest, Vol 10, Issue 23 Date: 26 September, 2013 2:00:23 PM CDT To: <security-announce(a)lists.apple.com<mailto:security-announce@lists.apple.com>> Reply-To: <security-announce(a)lists.apple.com<mailto:security-announce@lists.apple.com>> Send Security-announce mailing list submissions to security-announce(a)lists.apple.com<mailto:security-announce@lists.apple.com> To subscribe or unsubscribe via the World Wide Web, visit https://lists.apple.com/mailman/listinfo/security-announce or, via email, send a message with subject or body 'help' to security-announce-request(a)lists.apple.com You can reach the person managing the list at security-announce-owner(a)lists.apple.com When replying, please edit your Subject line so it is more specific than "Re: Contents of Security-announce digest..." Today's Topics: 1. APPLE-SA-2013-09-26-1 iOS 7.0.2 (Apple Product Security) ---------------------------------------------------------------------- Message: 1 Date: Thu, 26 Sep 2013 10:33:46 -0700 From: Apple Product Security <product-security-noreply(a)lists.apple.com> To: "security-announce(a)lists.apple.com" <security-announce(a)lists.apple.com> Subject: APPLE-SA-2013-09-26-1 iOS 7.0.2 Message-ID: <E44FE6C6-1A57-4F03-8F5A-9DC14B3B09B6(a)lists.apple.com> Content-Type: text/plain; charset=us-ascii -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-09-26-1 iOS 7.0.2 iOS 7.0.2 is now available and addresses the following: Passcode Lock Available for: iPhone 4 and later Impact: A person with physical access to the device may be able to make calls to any number Description: A NULL dereference existed in the lock screen which would cause it to restart if the emergency call button was tapped repeatedly. While the lock screen was restarting, the call dialer could not get the lock screen state and assumed the device was unlocked, and so allowed non-emergency numbers to be dialed. This issue was addressed by avoiding the NULL dereference. CVE-ID CVE-2013-5160 : Karam Daoud of PART - Marketing & Business Development, Andrew Chung, Mariusz Rysz Passcode Lock Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the device may be able to see recently used apps, see, edit, and share photos Description: The list of apps you opened could be accessed during some transitions while the device was locked, and the Camera app could be opened while the device was locked. CVE-ID CVE-2013-5161 : videosdebarraquito Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "7.0.2". Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJSQ2o5AAoJEPefwLHPlZEwmj8P/04PIEJuGhf8hv/IdYIHMLol chQHK/MXigk+aH9BriQbFpqAyByqyh9x4+6hJeywWdtF7u6SzfbRgBNoPWEZw0d8 VrtVBMi2VeNRTxOJWV+rivA7xA2doxkLSIILHzDVenj8JeNO87q85KsrhRmzmeaa jUojdE9o/0OGjjF1WuDM4UDGx/TzhpUoqzFR1hSP41g87xsYp/gRTV/R3821lxG6 8sUSeJ4l8qHFQKIUPAxJaSie8JbbK8Yeturix6sMCvYZdougtd7oMV5TxJVZXbC1 ePZUvhfVwuD7y5bFx2VKYvci5oFMgOlNyFZMDrkpM8BF2UsfEmvoHQPLwzYSdXXs 5wY/nwbuKm57Wq8PH0H3hyt4ycH0YB1YqxtY8oPjREJioA6mLHNGs70HFHvf+zjW 7ukGnI7c2efMMjoM0+UCmo03/5Wh8ji0tjrDjvM3gybm8keXH/cZPF13/kihXrs/ M6QVgWWjCO/IqhUh4MGDWzfzCqg+hlNJLAR/r1TocuDb4/NWj/nI2FHIoDIsNYjR XZ9qw0sIqsTF3nqf3zKhxEtXENEpSnGR7xGJ6xjcy8BCobHn81m7XKpnQFaNBido C669zPmyF0B6W0LiRmwvCp0Z6ielE0Tu3f9jsikOT/NUEqGFPtBhqR238G1rmHzH 6vDxXI1d8H2uZqoShAaZ =Nryx -----END PGP SIGNATURE----- ------------------------------ _______________________________________________ Security-announce mailing list Security-announce(a)lists.apple.com https://lists.apple.com/mailman/listinfo/security-announce End of Security-announce Digest, Vol 10, Issue 23 *************************************************

1 0

INTEREST: Apple, Android, Windows: resale value.
by Wayne Billing 15 Sep '13

15 Sep '13

….from: http://gizmodo.com/one-huge-reason-to-not-switch-to-android-or-windows-1301… [cid:5E9208DD-A124-4A7E-8485-84531F7D6E1F@cc.umanitoba.ca]<http://kylenw.kinja.com/> KYLE WAGNER<http://kylenw.kinja.com/> Thursday 2:00pm<http://gizmodo.com/one-huge-reason-to-not-switch-to-android-or-windows-1301…> One Huge Reason to Not Switch to Android or Windows<http://gizmodo.com/one-huge-reason-to-not-switch-to-android-or-windows-1301…> [cid:FAFB100C-495C-48A8-8835-98DD38400F91@cc.umanitoba.ca] iPhone pre-orders start tonight, and for a lot of people, that means deciding if you want to spend two years (or more) with a phone you've never held. The irony is, if you're not sure you want to commit for the full two years, then the answer is cut and dry: Get an iPhone. I've been trying to ditch my MacBook Air for an ultrabook for almost a year now. I just can't do it. Not because of Windows 8 or the laptops running it—those are great<http://bit.ly/15QyPXN>—but because I upgrade frequently. In order to do that without living out of a refrigerator box, I re-sell my old laptop to help pay for my new one. And that's kept me buying Apple stuff, even after it ceded ground in build quality and design, because reselling anything that isn't Apple is a losing proposition. It's been this way for years, of course, and this is the same reason I need a new phone, hate iOS, but hesitate to buy anything but an iPhone. The thing is, right now, Apple's no longer the obvious choice. You don't just go out looking for a new laptop and say, Oh, obviously, MacBook for me, like you did in 2009. Same goes for the iPhone, and to a lesser extent, the iPad. There's real choice now, real competition, but it doesn't matter. No one wants to buy anything fromyou, gently used, unless it's made by Apple. This isn't opinion. It's fact. We talked with executives from NextWorth<http://www.nextworth.com/> and Gazelle<http://www.gazelle.com/>, two of the largest sell-it-now, sell-it-easy operations out there, who were kind enough to share some data with us. They agreed: Just buy Apple if you're looking to get any cash back from your purchase. By NextWorth's count, the iPhone 4S and Samsung Galaxy S 2—the two premiere phones you'd be replacing in this two-year contract cycle on Android or iOS—are separated by a wide margin. The 4S retains more than a third of its original MSRP ($197 as of 8/29), while the S2 is down at 13 percent, which is well ahead of all other Android handsets from that generation. Meanwhile, you could have sold your old iPhone 5 for a healthy 36 percent of its initial value, as opposed to just 26 percent for the Galaxy S3. These are expensive products, which means those are big gaps, and again, the Samsung phones are the clear leaders of the non-iPhone pack. Everyone else fares much worse. The HTC One, a basically brand new and awesome phone, only gets you $104 right now. The individual prices here have shifted in the past few days, following the new iPhone announcement, obviously, but the fundamental calculus will remain in place for the next several product cycles. Gazelle doesn't paint a much more flattering picture. In fact, looking across the past few years of data, it's Apple in a landslide. Check out this graph from earlier this year: [One Huge Reason to Not Switch to Android or Windows]SEXPAND Broken Apple phones actually keep pace with LG's phones, and are only about $50 behind HTC. And Gazelle's current data mirrors what we saw earlier this year, and what Nextworth sees now: [One Huge Reason to Not Switch to Android or Windows]SEXPAND "Not only do Apple products hold their value well, but the demand for them is extremely high," Anthony Scarsella, Gazelle's Chief Gadget Officer, told us. And not by a little. By a lot. "It's a factor of two," says NextWorth's CMO Jeff Trachsel. "Apple products are generally worth about twice as much as other devices at the same period in their lifecycle." Even more telling is what neither of the vendors is involved in: Windows PCs and laptops. "One issue around them is obviously they don’t hold as much value as a premium Apple product," Scarsella says. "There are a lot of different build configurations and models, and have a lower MSRP. And just the demand for those products, there’s a lot more availability overseas, as well as the US." Translation: Good luck getting anyone to take that Dell off your hands. The same goes for categories like Windows 8 tablets (though the Surface is attracting some attention), and until recently, Android tablets, which sell, but are being hindered by their low starting values, which cause a lot of potential buyers to just opt for a brand new device instead. Why does this happen? The divide happens for two, maybe two and a half, reasons. First, there are just too damn many of everything but Apple products, and Apple's done a good job of cultivating a "Buy Apple or Buy Something Else" mentality. That's the supply part. The other reason, not surprisingly, is demand. Both demand for the entire Apple "half" of that equation, and just as importantly, demand overseas, where Apple products often aren't as readily available. If you've ever tried to sell your old PC or laptop, you know that first reason to be true. And that's not because of the quality of hardware anymore (though in the past, that sure didn't help). It's the configurations. "More choice is never a bad thing," you might see shouted on an all caps in an Android or Windows or Linux comments section. Except, that's extremely not true when it comes to resale. "Personally, I’ve sold laptops online before. You definitely have a different kind of buyer," Scarsella says. "Maybe a more tech-savvy buyer who’s looking for something very specific. With all the models out there, you need to know what you have, and understand the value there." But those buyers are far rarer than the ones who want no part of matching up processor SKUs. Thankfully, that's already changing. Android phones have seen a nominal amount of consolidation. There are still a ton of phones and tablets coming out, but most of the premium lines have whittled down to just one "hero" phone. Still, that means HTC competing with Samsung competing with Nokia competing LG for space in humanity's brain pans, while at the same time competing with lower-priced Android models. This is how a platform like Android wins the market share war<http://bit.ly/V4sBQ7>, but it's not a recipe for strong resales. PCs are in the same bind. All the OEMs like Lenovo and Acer and Samsung and Dell are focusing on premium lines with just a few products. And they're really damn nice, too. The Acer S7 11-inch is lust-worthy. Ditto the Samsung Series 9, Lenovo Yoga, and Dell XPS 13. The All-in-One lines are getting there too, running basically neck-and-neck with iMacs now. But they're all still just "Windows laptops" or "Windows desktops" to most folks. So what should you do? It'll take years for this dynamic to change. The design and build from Windows and Android and even Windows Phone OEMs is right there. But public perception can trail five or ten years, and even then, without a clear winner (like, say, a Microsoft Surface Laptop<http://bit.ly/UAIJ10>) they'll still have to deal with Spam vs. Apple. For now, I'm waiting on this next generation of computers. The second generation of ultrabooks was such a massive improvement over the first that it feels like this may well be the year that someone just falls out of bed and makes the perfect laptop. But it'll have to be pretty special to make up for the hundreds of dollars lost to upgrading out of a low-demand piece of hardware. That goes for the phone, too, if I continue to be an idiot and pay full price for a Verizon model to keep an unlimited data plan I don't even need. Now, a lot of you might not feel the need to upgrade every year, or even every two years. That's fair. But just know that for the millions of people who do sell early, Apple's got a pretty inescapable hook in them.

1 0

INTEREST: JAVA exploits and vulnerabilities
by Wayne Billing 12 Sep '13

12 Sep '13

Apple Inc's stand on JAVA from: http://support.apple.com/kb/HT5648 To help limit exposure to potential Java web app vulnerabilities, try to follow this best practice: • Enable Java in your web browser only when you need to run a Java web app. • Confine your web browser only to the websites that need the Java web app. Do not open any other websites while the Java web plug-in is enabled. • When you are done, disable the Java web plug-in. See How to disable the Java web plug-in in Safari<http://support.apple.com/kb/HT5241> …from: http://blog.trendmicro.com/trendlabs-security-intelligence/java-native-laye… Aug28 Java Native Layer Exploits Going Up<http://blog.trendmicro.com/trendlabs-security-intelligence/java-native-laye…> 11:34 am (UTC-7) | by Jack Tang (Threats Analyst)<http://blog.trendmicro.com/trendlabs-security-intelligence/author/jacktang/> [cid:C0519326-20FA-4330-B240-0A86DE8287B7@cc.umanitoba.ca]<http://www.facebook.com/sharer.php?u=http://blog.trendmicro.com/trendlabs-s…> Recently, security researchers disclosed two Java native layer exploits (CVE-2013-2465 and CVE-2013-2471). This caused us to look into native layer exploits more closely, as they have been becoming more common this year. At this year’s Pwn2Own competition at CanSecWest, Joshua Drake showed CVE-2013-1491, which was exploitable on Java 7 running on Windows 8. CVE-2013-1493 has become a popular vulnerability to target in exploits kits such as Blackhole. To understand why these exploits are becoming more common, some understanding of Java’s architecture is helpful. Java exploits can be divided into two types: Java layer exploits and Java native layer exploits. [cid:98796DF5-6A2B-4F1C-A93A-1E0B1F3533C0@cc.umanitoba.ca] Figure 1. Java security model The above graph shows the Java security model. Java layer exploits target vulnerabilities in the Java layer runtime, which lets applications bypass the Security Manager and call high privilege functions. These exploits have the following characteristics: * Can be created with less effort, because attackers need not bypass operating system-level protections. * Are cross-platform (i.e., work with multiple operating systems) Similarly, Java native layer exploits target the Java native layer runtime. These exploits are harder to create, as they need to bypass OS-level protections like ASLR and DEP. In addition, the skills needed to create native layer exploits are more difficult to acquire. [cid:55ED4DDE-CA1D-425B-AB86-31A4254F9247@cc.umanitoba.ca] Figure 2. Timeline of common Java vulnerabilities In the past, Java layer vulnerabilities were more common, but that is no longer the case. Before 2013, there was a 3:1 ratio of Java layer vulnerabilities to Java native layer vulnerabilities. Starting this year, however, we are now seeing more native layer flaws. Why is this the case? * A large amount of the vulnerabilities of are present in the Java native layer code. In the June 2013 Java SE Critical Patch Update Advisory, approximately half of all the vulnerabilities fixed were in the Java native layer code. * Attackers are becoming more skillful in creating exploits. In the past, while there were many native layer vulnerabilities, less exploits were present because attackers did not always have the skill to create the necessary exploits. This year, however, attackers clearly have the capability to take advantage of native layer vulnerabilities. Two methods of exploitation are becoming more common, One is to make use of a Java array length overflow to tamper with the java.beans. Statement object’s AccessControlContext member. To do this, the following steps are necessary: 1. Prepare a Java Array object on a heap.[cid:28A07EF0-F21E-4BBC-9F9F-38600A510D56@cc.umanitoba.ca] Figure 3. Step #1 2. Trigger a Java native layer vulnerability. The array object’s length is overflowed to a very large value.[cid:6EEA4532-7DE9-4175-883A-34377F8299F7@cc.umanitoba.ca] Figure 4. Step #2 3. An attacker can then use the array object to get or set the following buffer precisely. They can tamper with the following java.beans.Statement object’s acc field, which points to a AccessControlContext object. In general, the acc field will be tampered to point to a full permission AccessControlContext object. This will let arbitrary code be run on the affected system. [cid:D8AA3DCC-BE0E-4739-906F-239E7BE60BBF@cc.umanitoba.ca] Figure 5. Step #3 This exploit method requires that both the buffer which can be used to trigger vulnerability and the buffer which needs to be overwritten are in the same heap. It requires some knowledge and skill to ensure that this is the case. In addition to this, information leaks and ROP shell code attacks were demonstrated at Pwn2Own 2013. It gets the module base address by targeting a Java native layer vulnerability and constructing ROP shell code to hijack the execution context. We believe that 2013 will see more similar exploits along these lines. We urge users to carefully evaluate their usage of Java is necessary and ensure that copies of Java that are used are updated, to reduce exposure to present and future Java flaws. Update as of 9:28 AM PDT, Sept. 2, 2013 Trend Micro Deep Security provides protection for threats targeting CVE-2013-2465, CVE-2012-4681, CVE-2012-1723 via the following rules: * 1005598 – Identified Malicious Java JAR Files – 3 * 1004870 – Identified Suspicious Jar File * 1005093 – Java Applet Field Bytecode Verifier Cache Remote Code Execution Vulnerability * 1005640 – Oracle Java storeImageArray() Invalid Array Indexing Vulnerability Wayne Billing Classroom Technology Support Audio Visual and Classroom Technology Support 130 Machray Hall Building 204-474-6649 204-807-3153 (cell) 204-474-7625 (fax) Wayne_Billing(a)umanitoba.ca<mailto:Wayne_Billing@umanitoba.ca>

1 0