David Adams Archive
Linux Flaw Allows Attackers to Hijack Web Connections
Researchers discovered that a Transmission Control Protocol (TCP) specification implemented in Linux creates a vulnerability that can be exploited to terminate connections and conduct data injection attacks.
The flaw, tracked as CVE-2016-5696, is related to a feature described in RFC 5961, which should make it more difficult to launch off-path TCP spoofing attacks. The specification was formulated in 2010, but it has not been fully implemented in Windows, Mac OS X, and FreeBSD-based operating systems. However, the feature has been implemented in the Linux kernel since version 3.6, released in 2012.
A team of researchers from the University of California, Riverside and the U.S. Army Research Laboratory identified an attack method that allows a blind, off-path attacker to intercept TCP-based connections between two hosts on the Internet.
Researchers noted that data cannot be injected into HTTPS communications, but the connection can still be terminated using this method. One attack scenario described by the experts involves targeting Tor by disrupting connections between certain relays so that users are forced to use attacker-controlled exit relays.
Kaspersky launches KasperskyOS
How can journalists and activists (and regular folks) reduce their susceptibility to surveillance?
As the podcast mentions, mobile OS vendors and online services are getting a lot better at encrypting traffic and obscuring metadata, and one of the primary reasons for this was Edward Snowden's revelations about the ubiquity and sophistication of the NSA's surveillance, and by extension, the dangers of surveillance from other state agencies, black hat hackers, and legions of scammers. The Snowden revelations hit Silicon Valley right in the pocketbook, so that did impel a vast new rollout of encryption and bug fixing, but there's still a long way to go.
As a way of both highlighting and trying to fix some of the inherent vulnerabilities of smartphones in particular, Ed Snowden teamed up with famed hardware hacker Bunny Huang have been working on a hardware tool, specifically, a mobile phone case, that monitors the radio signals from a device and reports to the user what's really being transmitted. They explain their project in a fascinating article at PubPub.
Mobile phones provide a wide attack surface, since their multitude of apps are sharing data with the network at all times, and even if the core data is encrypted, a lot can be gleaned from metadata and snippets of unencrypted data that leak through. Journalists and activists generally know this, and often use Airplane Mode when they're worried their location may be tracked. Problem is, when agencies are using spearphishing attacks to remotely jailbreak iPhones and install tracking software, and there are even fears that OS vendors themselves might be cooperating with authorities, Snowden and Huang set out to allow users to monitor their devices in a way that doesn't implicitly trust the device's user interface, which may be hiding the fact that it's transmitting data when it says it's not. The article goes into great detail about the options they considered, and the specific design they've worked down to, and it looks terrific.
Interview with Steve Wozniak
Apple releases security patch after iPhone zero day exploit used on UAE political dissident
Ahmed Mansoor is an internationally recognized human rights defender, based in the United Arab Emirates (UAE), and recipient of the Martin Ennals Award (sometimes referred to as a “Nobel Prize for human rightsâ€). On August 10 and 11, 2016, Mansoor received SMS text messages on his iPhone promising “new secrets†about detainees tortured in UAE jails if he clicked on an included link. Instead of clicking, Mansoor sent the messages to Citizen Lab researchers. We recognized the links as belonging to an exploit infrastructure connected to NSO Group, an Israel-based “cyber war†company that sells Pegasus, a government-exclusive “lawful intercept†spyware product. NSO Group is reportedly owned by an American venture capital firm, Francisco Partners Management.
The ensuing investigation, a collaboration between researchers from Citizen Lab and from Lookout Security, determined that the links led to a chain of zero-day exploits (“zero-daysâ€) that would have remotely jailbroken Mansoor’s stock iPhone 6 and installed sophisticated spyware. We are calling this exploit chain Trident. Once infected, Mansoor’s phone would have become a digital spy in his pocket, capable of employing his iPhone’s camera and microphone to snoop on activity in the vicinity of the device, recording his WhatsApp and Viber calls, logging messages sent in mobile chat apps, and tracking his movements.
Indus OS, an Android distribution, has 5% of Indian mobile market
The average selling price of a smartphone in India is just $132, half that of China, so the market for low-end smartphones is brisk. On top of that, there are many languages spoken in india, and support for them in Google's Android and iOS is limited. This created an opening for an Indus OS, which has its own app store with 30,000 Android apps, most available in two or more local languages. Its installed based is currently around 4 million.
Getting started with Tails, the encrypted operating system
A step-by-step guide on how to download, install, and start using Tails, the world's most secure platform.
Tails, an encrypted and anonymous OS that bundles widely used open source privacy tools on a tiny device, is one of the most secure operating systems in the world. The Linux distribution rose to popularity when it was revealed Edward Snowden relied on Tails to secure his identity while sharing NSA secrets with journalists Glenn Greenwald and Laura Poitras. In the past half decade, Tails has been embraced as an essential security suite by journalists, hackers, and IT workers.
Time for a pen-first Microsoft OS (and it should be open source)
On the eve of launch of the latest generation of the Samsung Galaxy Note 7 we are reminded once again of Microsoft's failed Courier project, which was one of the first to propose a pen-first operating system.
Latest beta update makes PS4 software feel more like a real OS
Unlike the last major update, which added support for remote streaming to Macs and PCs, the 4.00 firmware beta (codenamed Shingen) is mostly focused on tweaking the PS4’s user interface. One of the biggest changes is the ability to create folders to organize your games and apps, instead of relying purely on Sony’s existing organizational tools. Another is that instead of taking over the whole screen, the Share and Quick menus will open as windows that don’t entirely cover your current game or app, and you’ll be able to add and remove items from the Quick menu to customize it.
How Smartphones Will Become Unboring
Self-driving Cars: User Interface Will Be The Key To Success
Volvo recently conducted a survey and asked consumers about their perceptions of self-driving cars. The question that stood out to me was whether a car company like Volvo or a technology company (Google, unnamed) was best positioned to bring safe self-driving cars to the market. Volvo was obviously fishing for a particular answer, and while they certainly have a vaunted reputation for technical innovation in the service of safety, I'm afraid I can't go along with the answer they're hoping for, partially because safety is only part of the story. In my opinion, no car company working alone is going to be able to produce a self-driving car with the kind of usability that consumers will expect. And for self-driving cars, usability is just as important as safety. In fact, they're inseparable.
Open Source Laptop
Jordan Hubbard Discusses NextBSD at BAFUG
Plasma Phone OS, a KDE project for mobile
Plasma Phone OS (or simply Plasma Phone) is a complete software stack for mobile devices and includes the following libre technologies: Plasma Mobile (a Plasma-based shell), KWIN/KWayland, Voicecall, Ofono, RIL, OHM, Telepathy. It allows to run several Qt-based applications to run on top of it, for example: Plasma apps, Ubuntu Touch based apps, Sailfish OS based apps, Nemo based apps.
The website is pretty minimal, but the first few comments on this Hacker News post gives a good overview.
If phones were designed to please their owners
BoingBoing posted a short movie by The MIT Media Lab's Knotty Objects group and noted hardware hacker Bunny Huang ask the question, "What if phones were designed to please their owners, rather than corporations?" In Southern China, where the majority of the world's mobile phones are made, there's a vibrant market for phones designed for all conceivable niches, where carrier subsidies, marketing campaigns, patents, trademarks, and other corporate-serving restrictions are ignored. If there's a possible market demand for a particular design, then someone makes a phone to meet that demand. It's a brief video, but worth a watch.