SI
SI
discoversearch

We've detected that you're using an ad content blocking browser plug-in or feature. Ads provide a critical source of revenue to the continued operation of Silicon Investor.  We ask that you disable ad blocking while on Silicon Investor in the best interests of our community.  If you are not using an ad blocker but are still receiving this message, make sure your browser's tracking protection is set to the 'standard' level.
Technology Stocks : Apple Tankwatch -- Ignore unavailable to you. Want to Upgrade?


To: iggyl who wrote (12297)11/8/2011 5:49:40 AM
From: sylvester80  Read Replies (2) | Respond to of 32692
 
BREAKING...After latest iPhone hack, researcher Charlie Miller kicked out of iOS dev program [ed: they kick out the guy who helps CrApple find bugs in their iPOS... if that isn't fascism I don't know what is...sheesh...]
By Ryan Naraine | November 8, 2011, 2:30am PST
zdnet.com
Summary: Charlie Miller defeats a major iOS security mechanism, a move that ruffles feathers in Cupertino.



Charlie Miller gets a kick of out defeating Apple’s security mechanisms, using his hacking skills to break into Macbooks and iPhones. Now, Apple has kicked the security researcher out of its iOS developer program after word got out that he built a proof-of-concept iPhone app to showcase a bypass of the code signing mechanism.

According to Forbes’s Andy Greenberg, Miller found a way to sneak an evil app into the iPhone/iPad app store and will demonstrate the vulnerability at the upcoming SysCan conference in Taiwan.

Miller plans to present a method that exploits a flaw in Apple’s restrictions on code signing on iOS devices, the security measure that allows only Apple-approved commands to run in an iPhone or iPad’s memory. Using his method–and Miller has already planted a sleeper app in Apple’s App Store to demonstrate the trick–an app can phone home to a remote computer that downloads new unapproved commands onto the device and executes them at will, including stealing the user’s photos, reading contacts, making the phone vibrate or play sounds, or otherwise repurposing normal iOS app functions for malicious ends.

Miller has created a video demonstrating the attack, which gave him enough control over the hijacked iPhone to control the device vibration or read files off the iPhone.

Greenberg writes that Miller effectively created a proof-of-concept app called Instastock that appears to merely list stock tickers, but also communicates with a server controlled by Miller, “pulling down and executing whatever new commands he wants.”

Details on the actual vulnerability being exploited is being kept under wraps until Apple issues a fix.

Just hours after word of his Miller’s app — which was approved by Apple — was publicized by Greenberg, Apple nuked Miller from the iOS dev program “effective immediately.”



To: iggyl who wrote (12297)11/8/2011 5:52:29 AM
From: sylvester80  Read Replies (1) | Respond to of 32692
 
BREAKING...iPhone Security Bug Lets Innocent-Looking Apps Go Bad (VIDEO)
11/07/2011 @ 2:38PM |21,119 views
forbes.com
Apple’s iPhones and iPads have remained malware-free thanks mostly to the company’s puritanical attitude toward its App Store: Nothing even vaguely sinful gets in, and nothing from outside the App Store gets downloaded to an iOS gadget. Now serial Mac hacker Charlie Miller has found a way to sneak a fully-evil app onto your phone or tablet, right under Apple’s nose.

At the SysCan conference in Taiwan next week, Miller plans to present a method that exploits a flaw in Apple’s restrictions on code signing on iOS devices, the security measure that allows only Apple-approved commands to run in an iPhone or iPad’s memory. Using his method–and Miller has already planted a sleeper app in Apple’s App Store to demonstrate the trick–an app can phone home to a remote computer that downloads new unapproved commands onto the device and executes them at will, including stealing the user’s photos, reading contacts, making the phone vibrate or play sounds, or otherwise repurposing normal iOS app functions for malicious ends.

“Now you could have a program in the App Store like Angry Birds that can run new code on your phone that Apple never had a chance to check,” says Miller. “With this bug, you can’t be assured of anything you download from the App Store behaving nicely.”

Update: Apple has terminated Miller’s developer license as a result of his research.

Here’s a video where he demonstrates the security vulnerability.

VIDEO: youtube.com

Miller, a former NSA analyst who now works as a researcher with consultancy Accuvant, created a proof-of-concept app called Instastock to show the vulnerability. The simple program appears to merely list stock tickers, but also communicates with a server in Miller’s house in St. Louis, pulling down and executing whatever new commands he wants. In the video above, he demonstrates it reading an iPhone’s files and making the phone vibrate. Miller applied for Instastock’s inclusion in the App Store and Apple approved the booby-trapped app. (Perhaps the company ought to have been more suspicious of an application in Miller’s name, given that he has hacked practically every device Apple has made since 2007 or so.)

I’ve reached out to Apple for comment but haven’t yet heard from the company. Given how seriously this exploit could affect the company’s crown jewels, expect a patch very soon.

Miller became suspicious of a possible flaw in the code signing of Apple’s mobile devices with the release of iOS 4.3 early last year. To increase the speed of the phone’s browser, Miller noticed, Apple allowed javascript code from the Web to run on a much deeper level in the device’s memory than it had in previous versions of the operating system. In fact, he realized, the browser’s speed increase had forced Apple to create an exception for the browser to run unapproved code in a region of the device’s memory, which until then had been impossible. (Apple uses other security restrictions to prevent untrusted websites from using that exception to take control of the phone.)

The researcher soon dug up a bug that allowed him to expand that code-running exception to any application he’d like. “Apple runs all these checks to make sure only the browser can use the exception,” he says. “But in this one weird little corner case, it’s possible. And then you don’t have to worry about code-signing any more at all.”

Miller won’t say just what that bug is until his talk next week in order to give Apple more time to fix the flaw.

Miller’s exploit in some ways resembles another hack created by John Oberheide in Google’s competing Android operating system. Using a program called Rootstrap, he showed how an innocent-looking Android app could download and run malicious code after making its way onto a user’s phone. (He used a fake Twilight-themed application to demonstrate the potential attack.)



To: iggyl who wrote (12297)11/8/2011 6:02:41 AM
From: sylvester80  Respond to of 32692
 
Apple expels security expert who exposed iPhone bug
TOI Tech & Agencies | Nov 8, 2011, 01.53PM IST
timesofindia.indiatimes.com

According to a security expert, a software flaw in Apple Inc's iPhones and iPads may allow hackers to build apps that secretly install programmes to steal data, send text messages or destroy information.

It's not easy to announce flaws in Applesoftware, as security expert Charlie Miller must have realised. A researcher with Accuvant Labs, Miller has been expelled by Apple from its developer programmes. The ejection notice reportedly comes shortly after Miller released early findings of a security hole in Apple's iOS software.

Announcing the news on Twitter, Miller wrote, "OMG, Apple just kicked me out of the iOS Developer program. That's so rude!"

According to Miller findings, a software flaw in Apple Inc's iPhones and iPads may allow hackers to build apps that secretly install programmes to steal data, send text messages or destroy information.

"Until now you could just download everything from the App Store and not worry about it being malicious. Now you have no idea what an app might do," Miller said.

Miller said he proved his theory by building a stock-market monitoring tool, InstaStock, that was programed to connect to his server once downloaded, and to then download whatever programme he wants.



To: iggyl who wrote (12297)11/8/2011 6:10:27 AM
From: sylvester80  Respond to of 32692
 
Apple boots security guru who exposed iPhone exploit
By Josh Lowensohn , CNET News on November 8, 2011 (9 hours ago)
zdnetasia.com
SummaryA prominent security researcher has been ousted from Apple's development programs after publishing research that demonstrated vulnerabilities in the company's mobile app software.

Security researcher Charlie Miller has been ejected from participating in Apple's developer programs, shortly after releasing early findings of a security hole in the company's iOS software.

Miller announced the news on Twitter, saying "OMG, Apple just kicked me out of the iOS Developer program. That's so rude!"

Earlier Monday Forbes' Andy Greenberg published a story featuring Miller, who is a well-known security researcher who targets Apple's products and services. Miller's latest discovery was a security hole in iOS that let applications grab unsigned code from third-party servers that could be added to an app even after it has been approved and is live on Apple's App Store.

To test the feature, Miller released a generic stock-checking app called InstaStock that could tap into his own server and grab bits of code to show that it worked. As noted in our original coverage, such behavior is grounds for dismissal from Apple's developer program, as spelled out in Apple's App Store guidelines.

Apple noted in its letter to Miller that he violated sections 3.2 and 6.1 of Apple's iOS Developer Program License Agreement (a separate agreement), which respectively cover interfering with Apple's software and services, and hiding features from the company when submitting them.

"I don't think they've ever done this to another researcher. Then again, no researcher has ever looked into the security of their App Store. And after this, I imagine no other ones ever will," Miller said in an e-mail to ZDNet Asia's sister site, CNET. "That is the really bad news from their decision."

Apple did not immediately respond to a request for comment on the matter.

Miller has highlighted numerous security flaws within Apple software over the years, with one of his most high-profile discoveries being a hack for the mobile version of Safari in 2007, shortly after the first iPhone was released. Additionally, he's been a fixture at the Pwn2Own security contest to gain control of Apple's Mac OS X computers through the built-in Safari Web browser. More recently, Miller detailed that the low-level system software that ships on all of Apple's recent-model batteries was protected by the same two passwords, letting would-be attackers theoretically disable the batteries given access to an administrator account.

In a tweet, Miller noted that he paid for his development accounts himself, despite the company doling out access to security researchers.



To: iggyl who wrote (12297)11/8/2011 6:17:00 AM
From: sylvester80  Respond to of 32692
 
Panasonic reveals industrial-strength Android tablets
by Stephen Shankland November 8, 2011 1:48 AM PST
news.cnet.com


Want to take your tablet into the shower? Panasonic's Toughpad A1 will oblige.
(Credit: screenshot by Stephen Shankland/CNET)

Panasonic has some good news for the kinds of people who worry about using their tablets in the rain, dropping them on a concrete floor, or using them outdoors in the desert.

The company announced yesterday that it plans to sell two models of rugged Android tablets under the Toughpad brand name starting in 2012. The 10-inch, $1,299 Toughpad A1 will arrive first, in the spring, and the 7-inch Toughpad B1 later in the year.
The 7-inch Panasonic Touchpad B1

(Credit: Panasonic)
Panasonic isn't aiming the Toughpads at the average consumer, but rather to various business users such as utility crews on the road, military staff in combat situations, or doctors making their rounds. It's a tablet extension of the approach the company already takes with its Toughbook line of rugged PCs.

But I still see the products as good news for average consumers as durability becomes a selling point. Gorilla Glass has meant that buyers of higher-end smartphones don't have to worry about screens scratched by keys and coins, and an ever-broader array of cameras and videocameras are shockproof and waterproof. Durability adds complexity and expense to a device, but it's a feature that I think customers will appreciate and pay for at least in moderate doses.

And even in Panasonic doesn't expect mainstream customers to be the core market for the devices, it's clearly still hoping the Toughbook line will improve the company's image. In a Toughpad promotional video, Panasonic derides the mainstream competition as "just a bunch of toys."

Rugged computers often take a hit compared to mainstream models, for example because the requirement to run in hot conditions demands a slower, cooler-running processor. But tablets, which already are designed to operate without a chip cooling fan, might not be at such a competitive disadvantage.

Indeed, the Panasonic Toughpad specs look reasonably competitive by today's standards, though it'll look a generation behind by the time it actually arrives in the fast-moving market that will see quad-core chips and Android 4.0 aka Ice Cream Sandwich arrive next year.

The Toughpad A1's ports seal up behind hatch covers.

(Credit: Panasonic)
Among the Toughbook A1's mainstream specs: a 1.2GHz dual-core processor; Android 3.2 aka Honeycomb; a "daylight-readable," LED-backlit, 1024x768 touchscreen display; 1GB of DDR2 memory; options for WiMax or LTE 4G wireless networking or more conventional 3G newtorking; a front-facing 2-megapixel camera and rear-facing 5-megapixel camera with an LED flash; ports for micro USB, micro SDHC, and HDMI; and a 33.9 watt-hour lithium-ion battery. It measures 10.5x8.3x0.67 inches and weighs 2.1 pounds.

The novel specs come later, though: operating temperatures between 14 degrees and 122 degrees Fahrenheit, drop-test rating to 4 feet, a magnesium alloy chassis with elastomer bumpers on the corners, hardware security features, the ability to withstand thermal shocks from rapid changes in temperature, a protected screen, port covers to keep out dust, vibration resistance, a field-replaceable battery, and compliance with the MIL-STD-810G military standard for environmental engineering. It's also got a stylus, a good feature for precision input.

With a price that's hundreds of dollars more than a conventional tablet, mainstream customers won't pay for the Toughpad. I wouldn't be surprised also if its daylight-readable, anti-glare screen doesn't look as good for those who mostly play games or videos indoors.

But speaking as a person whose iPad is afflicted with a big dent in one corner and whose Samsung Galaxy Tab's screen is popping out of its chassis, I do hope at least some of the Toughpad ethos spreads to the mainstream.

Via Android Guys.






To: iggyl who wrote (12297)11/8/2011 6:26:51 AM
From: sylvester80  Respond to of 32692
 
The iPad is just a cheap bad breakable toy... youtube.com



To: iggyl who wrote (12297)11/8/2011 7:08:58 AM
From: sylvester80  Respond to of 32692
 
Hands On: AT&T's 4G LTE Network in Boston; 10x FASTER than iPhone4Sux
AT&T powers up its blazing new 4G LTE network in Beantown, but does it measure up to Verizon? We jump in the car with a bunch of phones to find out.
By Jamie Lendino
November 6, 2011 03:02pm EST 6 Comments
pcmag.com
BOSTON—It's still nowhere near the size of Verizon's, but slowly but surely, AT&T is ramping up its 4G LTE network. Today, it flipped the LTE switch on four more cities: Boston, Washington D.C., Baltimore, and Athens, Georgia. That brings AT&T's total number of LTE markets to nine, including Atlanta, Chicago, Houston, San Antonio, and Dallas Fort-Worth.

Since I live in northeastern Massachusetts, I hit the road to run some tests in downtown Boston, Cambridge, and Brookline. I also stopped by West Newton, about five miles west of the city border, to see how far it extended. For this test, AT&T sent us two brand new phones: the Samsung Galaxy S II Skyrocket and the HTC Vivid. Both have a nifty little 4G LTE icon that lights up whenever you're in the right coverage area. For comparison purposes, I also brought along a Motorola Atrix 2, which supports AT&T's older HSPA+ 21 protocol, and the HTC Thunderbolt, which works on Verizon's LTE network.

First, let's get the big news out of the way: AT&T's LTE network is fast. With the right conditions, it's as speedy as Verizon's LTE network, or even faster, as we had found in our tests in Houston. I saw speeds in excess of 25 Mbps down, in fact. But it's not terribly consistent yet, at least in direct comparison to Verizon—and not unlike what we found in our nationwide Fastest Mobile Networks test earlier this year.

For example, in Cambridge ("A" on the map, above left) and downtown Boston ("B"), I saw easily repeatable 25 Mbps+ results on Verizon, but AT&T results hovered in the 15 Mbps to 16 Mbps range—which is still extremely fast for a cellular data connection. In Brookline ("C"), AT&T took the lead, with results surpassing 25 Mbps, whereas Verizon LTE fell to about 10 Mbps down in my test location. Once I drove out to West Newton ("D"), LTE performance degraded on both Verizon and AT&T, at least to the point where it was now equivalent to a fast HSPA+ conncetion (in the 8 Mbps to 10 Mbps range).

At first, I had trouble achieving LTE-like speeds with the HTC Vivid, but it turned out AT&T didn't provision its SIM card correctly. I confirmed this by swapping the SIM cards; once I did that, the Vivid hit LTE consistently, and the Skyrocket stopped connecting to it, showing only "4G" instead (like other HSPA+ phones on AT&T). Once I learned this, I doubled back and redid my Cambridge results, just to make sure both phones pulled down the same numbers on AT&T 4G LTE (they did).

Reception Quality Is Important
That said, the handset itself has a lot to do with the equation. When you put the Skyrocket next to the Vivid, it's clear the Skyrocket is both thinner and lighter; in fact, it looks just as thin as an original 3G Galaxy S. Considering the new model contains LTE support, it's a pretty amazing feat of engineering—that is, until you try and use it. Unfortunately, Samsung sacrificed reception quality to get the Galaxy S II Skyrocket so thin. Several times during the test, the Skyrocket latched onto 4G LTE, but then failed to deliver data. That's despite waiting over a minute, and after a reboot to double-check. The HTC Vivid, on the other hand, performed much more consistently in the same locations that had given the Skyrocket trouble. This is why we test reception so heavily in each and every one of our reviews, incidentally.

Another surprise: the Atrix 2, with its HSPA+ 21 radio, delivered results all over the board, from a low of 2100 Kbps down (roughly equal to HSPA 7.2 on a good day), to a very fast 13 Mbps down (which is squarely in LTE territory, if on the low end).

I'm glad I had both LTE phones for this test, because if AT&T had just sent me the Skyrocket (and with the good SIM), I would have ended up thinking AT&T's LTE network was spotty and inconsistent. Instead, I can report that while AT&T LTE doesn't extend quite as far as Verizon LTE in Boston, and doesn't always reach the same speeds, it's capable of the same blistering performance with the right conditions. All told, not bad for a launch day.

If any of this interests you, AT&T 4G LTE customers can get 200MB for $15 per month, and an additional $15 for another 200MB with DataPlus. AT&T's DataPro plan offers 2GB for $25 per month, plus $10 per gigabyte afterwards. You can also use your phone as a mobile LTE hotspot for $45 per month; that plan comes with 4GB of data.

In the meantime, look for full reviews of the Skyrocket and the Vivid soon.

For more from Jamie, follow him on Twitter: @jlendino.