exploit

The 404 960: Where we tweet from our seats (podcast)

Leaked from 404 Podcast 960:

Facebook exploit exposes Mark Zuckerberg's private photos. Theaters set aside tweet seats for Twitter users. Finally: an app that can detect Photoshopping. Rumor: Apple to release 32-55 inch TVs next year.… Read more

Update Java to thwart active cross-platform exploit

There is a rather serious vulnerability in Java version 1.6.0_26 that is apparently being actively pursued by hackers, one that is easy to implement and allows hackers to compromise systems without being detected.

The exploit was found a couple of months ago and was addressed in the latest round of Java updates both from Oracle and from Apple for OS X users; however, many people have not yet updated their systems and hackers are working to take advantage of this flaw on these systems.

The vulnerability allows a maliciously crafted Java applet to run undetected on many browsers … Read more

iPhone security hole lets apps run unsigned code

A newly-discovered security hole in Apple's iOS opens up the door for third-party applications to add unapproved features, even after they've gone through Apple's App Store approval process.

Forbes today reports on new findings by Accuvant security researcher Charlie Miller, who next week is taking the wraps off a new iOS exploit he found that lets applications download unsigned code that's able to change their functionality after it's installed.

The exploit makes use of an exception that was added to Apple's Safari mobile browser in iOS 4.3 last year, which gives JavaScript special … Read more

FBI releases child ID iPhone app

The FBI has released the FBI Child ID app, the first mobile app created by the bureau. The app is designed to help parents notify authorities in the unlikely event that their child goes missing.

It is currently available only for the iPhone but also works on the iPad and iPod Touch. (A device with a camera is required to use the app to take a photo of the child.)

Parents can use the app to record information about each of their kids and take a photo of each kid from directly within the app. There are also fields for … Read more

Researcher: Mac notebook batteries can be hacked

The chip that helps control your Mac notebook's battery could be the latest target for attackers.

A report in Forbes today details the findings of Accuvant security researcher Charlie Miller, who claims to have found rather lackluster security guarding the firmware that controls various notebook battery functions and data stores.

Culling through a battery firmware update Apple released back in 2009, Miller pulled out two passwords that would grant access to that firmware, giving would-be attackers the ability to alter readings sent back to the OS and even add small software programs that stay off the hard drive. Miller … Read more

iOS 5 targets longtime iPhone jailbreak exploit

The software hole involved in a popular method for jailbreaking Apple's iOS devices has reportedly been patched by the company as part of iOS 5, the free system software update that's due out later this year.

Digging through the beta version of iOS 5, which Apple made available to developers earlier this month, the iPhone Dev-Team--a group of hackers that targets Apple devices and is not to be confused with Apple's group that designs the iOS software--has discovered a change that threatens to close a loophole the group has long exploited.

"Those of you who have been jailbreaking for a while have probably heard us periodically warn you to 'save your blobs' for each firmware.... Saving your blobs for a given firmware on your specific device allows you to restore *that* device to *that* firmware even after Apple has stopped signing it," the group wrote on its blog yesterday. "That's all about to change."

The group says Apple has implemented a system that checks for a uniquely generated chunk of data each time the phone is restored. The problem there is that only Apple has the keys to unlock that code to let the phone boot up successfully. The end result is that jailbreaking methods that took advantage of that vulnerability could be endangered if that same system is employed in the final version of the software.

The iPhone-Dev Team notes that "there may still be ways to combat this" but that it's not showing its cards just yet, since it might give Apple time to make a fix ahead of a general release. "They've stepped up their game!" the group said of Apple's security efforts.

Apple's iPhone and other iOS devices continue to be hot targets for hackers. Ahead of the release of the App Store, one of the most popular reasons to jailbreak an iOS device was to be able to install third-party software. Even after the launch of the App Store, places like third-party app repository Cydia became destinations for developers who couldn't get their applications through Apple's approval process. Another popular reason was to unlock the iPhone so that it would work on other carriers, an option Apple now offers to U.S. buyers at a hefty price premium.

iOS 5 is due out this fall. Last week Apple released a second beta of the software to developers so they could use it to test their applications for compatibility with the OS and its new features. The first beta of the software was allegedly jailbroken by a member of the iPhone-Dev Team in less than 24 hours.… Read more

Sony takes sites down after log-in exploit found

Just days after most services for PlayStation Network were brought back online, it appears a new exploit has been discovered that allows hackers to change users' passwords with the data stolen during the break-in to the service last month.

The Web sites that allow PSN users to sign in and reset their passwords have since been taken offline, as the graphic above from PlayStation.com shows. This problem reportedly does not affect the ability to sign in via a PlayStation 3 or PlayStation Portable, just some Sony Web sites.

The report comes from gaming blog Nyleveia, which posted a warning to PSN users … Read more

Report: Windows 7 almost five times more secure than XP

Windows 7 is four to five times less vulnerable to malware infections than is Windows XP.

Those are the findings of Microsoft's latest Security Intelligence Report (PDF), which detailed in depth the state of software vulnerabilities, exploits, security breaches, and malware in 2010.

Overall, the study found that infection rates for newer Microsoft operating systems with the latest service packs are consistently lower than those for older OSes, giving Windows 7 and Windows Server 2008 R2 the highest marks for security.

Looking at the number of reported infections per 1,000 computers, Microsoft found that Windows 7 64-bit had … Read more

How bin Laden evaded the NSA: Sneakernet

Far from being a technological recluse, Osama bin Laden was a prolific e-mail writer who reportedly relied on flash drives, couriers, and sneakernet to keep in touch with his correspondents.

Although bin Laden's hideout in Pakistan lacked phone and Internet connectivity, the al Qaeda leader used his computers to prepare messages and save them on flash drives, which would be passed to a courier, according to the Associated Press. The courier would head to a far-flung Internet cafe, send the outgoing messages, retrieve the incoming ones, and then return to Abbottabad with the responses.

That physical couriering of data, … Read more