Chinese smartphone maker Coolpad has created an extensive “backdoor” into its Android devices that can track users, serve them unwanted advertisements and install unauthorized apps, a U.S. security firm alleged today.
In a research paper released today, Palo Alto Networks detailed its investigation of the backdoor, which it dubbed “CoolReaper.”
“Coolpad has built a backdoor that goes beyond the usual data collection,” said Ryan Olson, director of intelligence at Palo Alto’s Unit 42. “This is way beyond what one malicious insider could have done.”
Coolpad, which sells smartphones under several brand names — including Halo, also called Danzen — is one of China’s largest ODMs (original device manufacturers). According to IDC, it ranked fifth in China in the third quarter, with 8.4% of the market, and has expanded sales outside of the People’s Republic of China (PRC) and Taiwan to Southeast Asia, the U.S. and Western Europe.
Tipped off by a string of complaints from Coolpad smartphone users in China and Taiwan — who griped about seeing advertisements pop up and apps suddenly appear — Palo Alto dug into the ROM updates that Coolpad offered on its support site and found widespread evidence of CoolReaper.
Of the 77 ROMs that Palo Alto examined, 64 contained CoolReaper, including 41 hosted by Coolpad and signed with its own digital certificate.
Other evidence that Coolpad was the creator of the backdoor, said Olson, included the malware’s command-and-control servers — which were registered to domains belonging to the Chinese company and used, in fact, for its public cloud — and an administrative console that other researchers had found last month because of a vulnerability in Coolpad’s backend control system. The console confirmed CoolReaper’s functionality.
Hundreds of thousands of websites running WordPress have been infected by a piece of malware called SoakSoak. Google has flagged more than 11,000 domains hosting a WordPress website as malicious.
Websites running a third-party plug-in called Slider Revolution are being hacked, and malicious code is being installed that will in turn infect those who visit the website. The developers of the plug-in, ThemePunch, have admitted that they knew about the vulnerability in February this year but kept quiet about it.
ThemePunch in developed 29 security fixes from February to September, resisting a public call for action because of a “fear that an instant public announcement would spark a mass exploitation of the issue”.
The company had hoped that most users would install these updates, solving the problem, but it now admits that this was “sadly not the case.”
“We as a team would like to apologize officially to our clients for the problems that arose due to the security exploit in Revolution Slider Plugin versions older than 4.2, ? it says on its website.
Short answer is that you have to upgrade everything that moves on your wordpress site or it will be toast.
Red Hat has announced the availability of Red Hat Enterprise Linux (RHEL) 7.1 Beta with enhancements to improve ease of use, manageability and performance, as well as support for IBM Power8 little endian architecture.
RHEL 7.1 Beta is the next point release following the enterprise Linux vendor’s initial production release of RHEL 7.0 in June.
RHEL 7.1 adds OpenLMI support to streamline system configuration management with thin logical volume manager provisioning, along with kernel and user mode components supporting Ceph block storage devices.
The update also offers support for Microsoft CIFS for mixed vendor data centre environments that need it, providing native access to Microsoft Windows file and print services.
RHEL 7.1 also enhances identity management security with one-time password authentication via LDAP and Kerberos protocols and the FreeOTP standard, and introduces a certificate authority management tool.
In addition, RHEL 7.1 includes Security Content Automation Protocol Security Guides that reduce the complexity of compliance testing and enhance security assurance.
Building on RHEL 7.0 support for Linux containers in physical, virtual and cloud deployments in development, test and production environments, RHEL 7.1 adds access to Docker 1.2 in the RHEL 7 Extras channel.
For users with demanding workload responsiveness requirements, RHEL 7.1 adds real-time dispatching for workloads that require very precise and deterministic processing times. This capability is delivered with Linux kernel enhancements and additional userspace packages that can be added on top of a stock RHEL 7.1 installation.
Finally, RHEL 7.1 includes support for IBM Power8 little endian architecture for customers using the IBM Power8 systems infrastructure.
Running in little endian mode accelerates application portability to the IBM Power8 systems, thus allowing customers using IBM Power8 systems to use the existing ecosystem of Linux applications as developed for the x86 architecture.
Interested users can read the RHEL 7.1 Beta Release Notes, and can download the RHEL 7.1 Beta at Red Hat’s website.
Sources are sighting a rating seen on the Australian classifications that seem to point to an upcoming Remastered Edition of Borderlands is coming for Xbox One and PlayStation 4. So far this has remained unconfirmed by publisher 2K and franchise developer Gearbox.
The new remastered version is expected to be simply called “Borderlands Remastered Edition”, but with no confirmation from 2K and Gearbox it is difficult to say what all it might contain or if it is simply a converted and compiled version of the first three games for the Xbox One and PlayStation 4.
Bottom line if it is in fact a complied remastered release of the first three games, the reality is that this could actually be a good thing for those that own the new consoles.
“While the Internet of Things (IoT) conjures a vision of ‘anytime, any place’ connectivity for all things, the realization is complex given the need to work across interconnected and heterogeneous systems, and the special considerations needed for security, privacy, and safety,” co-wrote Google chief Internet evangelist Vint Cerf, in a blog post announcing the research program.
The ”Internet of Things” is technical shorthand describing what is expected to be a mass wave of portable devices and sensors that will gather information and send it over the Internet for purposes of analysis and monitoring. Over 50 billion things will be connected to the Internet by 2020, Cisco has estimated.
Google plans to issue two sets of awards, both meant to fuel work to be carried out over a year.
One set of grants will be for larger team projects that Google will pay between $500,000 and $800,000 to see completed. Google expects that the work could be undertaken either by an academician leading a team of researchers or by a graduate student “willing to dedicate a substantial portion of their research time to this expedition,” according to Google’s request for proposals document.
A smaller set of grants, ranging from $50,000 to $150,000, will also be given out. For these grants, Google is looking for “new and unorthodox solutions” in user interface and application development, in privacy and security, and in systems and protocols research, according to the blog post.
Intel’s platform is like a set of building blocks based on the chipmaker’s components and software for companies to create smart, connected devices, Doug Davis, head of Intel’s Internet of Things business, said at a launch event in San Francisco.
It also aims to make it easier to connect to data centers in order analyze data collected from devices’ sensors.
“We’re creating compute capability in end-point devices that scale from our highest performance Xeon processor to the Quark family of products,” Davis said, referring to Intel’s chips.
After moving slowly in recent years to adapt its personal computer chips for smartphones and tablets, Intel is determined to make sure it is on the leading edge of future computing trends, industry experts and company executives have said.
Adding processors, sensors and web connectivity to devices from soccer balls to industrial machinery, an emerging trend dubbed the Internet of Things, has become a new battleground for Intel, rival Qualcomm and other technology companies.
The install base of wireless gadgets will more than double by the end of the decade, with most of the growth coming from smart devices other than PCs and smartphones, according to market research firm ABI Research.
Intel’s Internet of Things Group had $530 million in revenue in the September quarter. That accounted for just 4 percent of Intel’s total revenue in the quarter, but it grew 14 percent over the previous year, which was faster than the company’s PC business.
Dell, SAP, Tata Consultancy, Accenture and other companies are working with the new reference model, Davis said.
Sony Corp’s movie studio could face tens of millions of dollars in costs from the massive network breach that severely hindered its operations and exposed sensitive data, according to cybersecurity experts who have studied past breaches.
The tab will be less than the $171 million Sony estimated for the breach of its Playstation Network in 2011 because it does not appear to involve customer data, the experts said.
Major costs for the attack by unidentified hackers include the investigation into what happened, computer repair or replacement, and steps to prevent a future attack. Lost productivity while operations were disrupted will add to the price tag.
The attack, believed to be the worst of its type on a company on U.S. soil, also hits Sony’s reputation for a perceived failure to safeguard information, said Jim Lewis, senior fellow at the Center for Strategic and International Studies.
“Usually, people get over it, but it does have a short-term effect,” said Lewis, who estimated costs for Sony could stretch to $100 million.
It typically takes at least six months after a breach to determine the full financial impact, Lewis said.
Sony has declined to estimate costs, saying it was still assessing the impact.
The company has insurance to cover data breaches, a person familiar with the matter said. Cybersecurity insurance typically reimburses only a portion of costs from hacking incidents, experts said.
Seagate has announced its first drive based on shingled magnetic recording (SMR), a new technology that could give mechanical drives another lease on life.
The first Seagate product to be based on SMR technology is an 8TB hard drive priced at $260, which sounds like relatively good value given the pricing of traditional 4TB drives.
Seagate markets the new product as an ‘Archive HDD’ which makes perfect sense – few people would use a huge 3.5-inch unit as their system drive. Such drives are usually used solely for storage, paired with a speedy 250GB-class SSD acting as the system drive.
Another angle is power efficiency. SMR is supposed to deliver superior efficiency, making the drives even more suitable to the archive role.
However, the first drive (ST8000AS0002) is no slouch. It is a 5900rpm unit with 128MB cache, with average read and write speeds on 150MB/s. The MTBF is 800,000 hours, which sounds encouraging.
Seagate is not the only outfit working on SMR drives – in fact all hard drive makers are. The new technology allows Seagate to produce 1.33TB platters, or 33% more than previous generation drives that maxed out at 1TB per platter. The increase in density is made possible by changing the way data is stored compared to perpendicular recording.
This means SMR drives can be slimmer, quieter, more efficient and of course cheaper. It also means that we will get some weird capacities. For example, Seagate is already talking about 5TB drives. The company plans to launch 5TB, 6TB and 8TB models based on SMR.
The trade-off is that SMR drives will end up somewhat slower than perpendicular drives, but then again they will be cheaper. In fact, the new 8TB drive is expected to end up about 10% cheaper than perpendicular 6TB drives.
You can check out Seagate’s video explaining the new technology after the break.
The economy added 321,000 jobs overall in November — and IT hiring was part of the upswing.
David Foote, the CEO of Foote Associates, an IT labor analyst and research firm, said the number of new IT jobs stood at 17,300 in November, compared to 12,900 in October. Similarly, Janco Associates, a consulting firm that tracks IT hiring, reported a gain of 12,700 IT jobs in November, compared to 6,900 in October.
The differences between the Foote and Janco numbers reflect the categories of U.S. Labor Department data each uses to create their analyses. But both show an uptick and the analysts agree on what the findings show: November was a good month for hiring in general and IT hiring in particular.
Foote sees some trends in his research that are underlying the employment gains. When the economy turned down in 2008, many firms shed IT workers, along with many others, and then shifted to consulting firms and contract workers to fill gaps and take on new projects. Firms are now “systematically replacing consultants with full-timers” as well as expanding their staffs, said Foote.
An earlier survey by Computer Economics buttresses the view that the climate for full-time hiring is improving. The research firm identified IT managers at mid-sized to large firms and found a slight majority were planning to hire more full-time workers.
The IT professionals employers are seeking fall into several areas, said Foote. They want people with business and technical skills, analysts, architects and software engineers, as opposed to traditional infrastructure jobs.
People with specialized skills, such security or data analytics, are also in demand, and that’s been a reflected in the willingness of companies to pay premiums for certain types of certifications, said Foote.
In Foote’s analysis, the monthly IT job gains in November were the second largest of the year, following September, at 22,700 new jobs.
“The recovery is well underway for IT pros,” Victor Janulaitis, the CEO of Janco, said in a statement.
Ubuntu Snappy in cooperation with Microsoft Azure on Tuesday, the alpha preview of a minimalist Ubuntu Core virtual machine implementation for cloud deployments of Linux applications software running in Docker containers.
Canonical said: “Today we’re announcing ‘snappy’ Ubuntu Core, a new rendition of Ubuntu for the cloud with transactional updates.
“The snappy approach is faster, more reliable, and lets us provide stronger security guarantees for apps and users – that’s why we call them ‘snappy’ applications.”
Ubuntu Snappy is the Ubuntu Core Linux operating system along with atomic image updating for the operating system and applications software running in Docker containers.
“Ubuntu Core provides transactional updates with rigorous application isolation,” said Canonical and Ubuntu founder Mark Shuttleworth.
“This is the smallest, safest platform for Docker deployment ever, and with snappy packages, it’s completely extensible to all forms of container or service. We’re excited to unleash a new wave of developer innovation with snappy Ubuntu!”
Canonical explained that Snappy apps and Ubuntu Core can be upgraded atomically and rolled back if needed, which it described as a “bulletproof” approach to systems management that is ideal for container deployments.
“It’s called ‘transactional’ or ‘image-based’ systems management, and we’re delighted to make it available on every Ubuntu certified cloud,” the firm said.
Microsoft corporate VP Bob Kelly added: “Microsoft Azure provides an alpha preview trial hosting environment based on the Docker container framework. For Canonical, business partners are where you find them, we reckon.
“Microsoft loves Linux, and we’re excited to be the first cloud provider to offer a new rendition of one of the most popular Linux platforms in the rapidly growing Azure cloud.
“By delivering the new cloud-optimised Ubuntu Core image on Azure, we’re extending our first-class support for Linux and enabling freedom of choice so developers everywhere can innovate even faster.”
Docker CEO Ben Golub claimed that Docker’s transactional application delivery is shaping modern application development and DevOps practice, and that snappy Ubuntu brings the same transactional updates to the operating system itself.
“We’re delighted to see the Docker ecosystem expand with this exciting new platform,” he added.
Canonical released Ubuntu Server 14.10 with support for OpenStack cloud deployment in October.
BlackBerry Ltd and NantHealth, a healthcare-focused data provider,has rolled out a secure cancer genome browser, giving doctors the ability to access patients’ genetic data on the BlackBerry Passport smartphone.
Earlier this year, BlackBerry bought a minority stake in privately held NantHealth. The mobile technology company sees healthcare as one of the niche sectors in which it has an advantage, due to the heightened focus on patient privacy and BlackBerry’s vast networks that can manage and secure data on mobile devices.
The company said the cancer genome browser on the BlackBerry Passport enables deep, interactive reporting on genomics data for physicians. It gives oncologists a tool to view individual genetic patterns in a disease and allows them to highlight relevant treatment options.
BlackBerry launched the square-screened Passport device in September, the oddly shaped device was fashioned in a sense to tailor to the needs of the physicians, with a wider screen that allows for better viewing of X-rays, scans and documents.
“Our partnership with BlackBerry has really been able to create a scalable super-computer in the palm of the hands of the doctor,” said Patrick Soon-Shiong, chief executive of NantHealth.
BlackBerry Chief Executive John Chen said he expects this roll-out to get healthcare professionals interested in the Passport.
The genome browser is fully encrypted to allow deployment to enable clinicians to securely access patient data as soon as it is available, wherever they are.
The browser will be demonstrated at the Consumer Electronics Show (CES) in Las Vegas in January and it will be pre-loaded on BlackBerry Passport devices and available to the professional community in early 2015. The browser will also be available on certain other devices running on rival platforms, but secured by BlackBerry’s network.
The company said Friday that the cardholder name, account number, expiration date, and verification code could have been stolen by hackers who apparently had access to the company’s payment processing system between Nov. 8 and 26.
The incident came to light in late November when Bebe said it noticed suspicious activity on computers that operate the payment processing system. Stores affected were the roughly 200 it operates in the U.S., Puerto Rico and the U.S. Virgin Islands.
“If you used a payment card at a U.S., Puerto Rico or U.S. Virgin Islands store during this time frame, you should review your account statements for any unauthorized activity,” it said in a message to customers.
The last couple of years have been bad ones for the safety of credit card data at major U.S. retailers. Millions of credit and debit card numbers have been compromised in breaches at retailers, including Target, Home Depot, PF Chang’s restaurants, Super Valu grocery stores, Neiman Marcus, UPS Store and others.
In many cases, the attacks were targeted at payment processing terminals and used sophisticated malware that stole card details as consumers swiped their cards. Many of the thefts were only discovered after the card numbers appeared for sale on Internet hacking forums.
Such was the case with Bebe Stores. First news of the hack came earlier this week through the closely followed Krebs on Security blog.
Michael Fey has left Intel Security Group to become chief operating officer at Blue Coat. Blue Coat is apparently not the traditional garb of a British Holiday Camp entertainer, but apparently a privately owned network security company.
Fey was one of the few top McAfee managers to stay with the company after it was bought by Intel in 2011. McAfee is now part of Intel Security Group, where Fey had been chief technology officer. Fey said that his role at Blue Coat would be “very similar” to his old job but he was allowed to focus on the cloud and the advanced threats space more.
“Blue Coat had tremendous growth behind the scenes and now I get to focus on taking that growth and trying to get it to the billion-dollar revenue mark,” he told Reuters.
Since the $7.7 billion acquisition by Intel, McAfee has lost senior managers and key talent in technology development, research and sales. At Blue Coat, Fey will replace David Murphy, who will stay on as a strategic adviser to the board.
The World Semiconductor Trade Statistics (WSTS) organization released its autumn 2014 industry forecast on Tuesday, predicting that the semiconductor market will continue to grow next year.
The WSTS reported that the global semiconductor market will see nine percent growth year over year in 2014 to $333bn, driven mainly by double digit growth in memory shipments and supported by growth in all other product categories.
The trade group said that the highest rates of growth this year are in memory products (17.3 percent), discrete products (12.3 percent) and analogue devices (10.3 percent).
Semiconductor shipments grew in all geographical regions this year, according to the WSTS, driven largely by strong demand in the smartphone and automotive markets.
Assuming that the global economic recovery will continue into 2015 and beyond and the strong semiconductor markets will continue to mature, the WSTS forecasts continuing steady, although moderating, market growth in all product categories and regions next year.
The WSTS forecasts that the worldwide semiconductor market will increase 3.4 percent in 2015 to $345bn, and 3.1 percent in 2016 to $355bn.
The automotive and communications product categories will show stronger growth than the global market as a whole, while consumer and computer product shipments will remain almost flat in the forecast period.
Asia-Pacific, which already accounts for nearly 60 percent of the global market, will continue to show the fastest growth in 2016, reaching a value of $209bn, according to the predictions.
In June, Gartner predicted that the global semiconductor market would increase to $336bn in 2014, which it reckoned would be 6.7 percent growth for the year.
The WSTS produces semiconductor industry forecasts in May and November each year.
The company said it will now require less information from users flagging inappropriate content and that it will be easier to submit tweets and accounts for review, even when wrongful behavior is simply observed and not received directly.
“We are nowhere near being done making changes in this area,” Shreyas Doshi, director of product management and user safety said in a message posted on Twitter’s website.
“In the coming months, you can expect to see additional user controls, further improvements to reporting and new enforcement procedures for abusive accounts.”
Users also will be able to view all the accounts they have blocked in a new blocked accounts page accessible from the settings menu on Twitter.
The changes, which will be rolled out to all users in the next few weeks, include modifications designed to speed up Twitter’s response by better streamlining and prioritizing reports of abusive content, technology news website The Verge reported.
A way to block multiple accounts at once also appears to be in the works, according to The Verge.
Twitter has faced criticism in the past over a response to harassment and abuse deemed too lax by many of its users.
In December last year, the company was forced to nix a change to its “block” feature under criticism that the new policy still allowed blocked users to interact with those who had blocked them.
Earlier this year, a survey by online advocacy groups found that nearly half of Americans under the age of 35 have been bullied, harassed or threatened online.
Twenty-four percent of the people surveyed said the harassment happened on Twitter.