Yahoo Messenger Flaw Exposed

An unpatched Yahoo Messenger vulnerability that allows hackers to change people’s status messages and possibly perform other unauthorized functons can be exploited to spam malicious links to a large number of users.

The flaw was discovered in the wild by security researchers from antivirus vendor BitDefender while investigating a customer’s report about unusual Yahoo Messenger behavior.

The flaw appears to be located in the application’s file transfer API (application programming interface) and allows attackers to send malformed requests that result in the execution of commands without any interaction from victims.

“An attacker can write a script in less than 50 lines of code to malform the message sent via the YIM protocol to the attacker,” said Bogdan Botezatu, an e-threats analysis & communication specialist at BitDefender.

“Status changing appears to be only one of the things the attacker can abuse. We’re currently investigating what other things they may achieve,” he added.

Victims are unlikely to realize that their status messages have changed and if they use version 11.5 of Yahoo Messenger, which supports tabbed conversations, they might not even spot the rogue requests, Botezatu said.

This vulnerability can be leveraged by attackers to earn money through affiliate marketing schemes by driving traffic to certain websites or to spam malicious links that point to drive-by download pages.

Source….

at&t Partners With China Telecom

AT&T Inc and China Telecom have agreed to broaden the range of their partnership in China and the United States and will look into supporting each other in other regions.

AT&T said the agreement would expand its services for business customers in China and that the companies would consider jointly developing services, including video conferencing and managed hosting.

Source…

Kindle Fire Raises Privacy Concerns

Amazon told a Massachusetts congressman that the Silk browser in its Kindle Fire tablet doesn’t pose a privacy threat to customers, but the lawmaker wasn’t satisfied with that statement.

U.S. Rep. Ed Markey (D-Mass.), the co-chairman of a congressional caucus on consumer privacy, on Tuesday released the results of questions he had put to Amazon CEO Jeff Bezos in October about Silk and the data it collected.

Markey wasn’t happy with Amazon’s answers.

“Amazon’s responses to my inquiries do not provide enough detail about how the company intends to use customer information, beyond acknowledging that the company uses this valuable information,” said Markey in a statement.

“Amazon states ‘Customer information is an important part of our business,’ but it is also important for customers to know how the company uses their personal information,” Markey continued. “Amazon is collecting a massive amount of information about Kindle Fire users, and it has a responsibility to be transparent with its customers. I plan to follow-up with the company for additional answers on this issue.”

Silk, which is based on the open-source WebKit engine, connects to Amazon’s cloud service and servers by default. The service will handle much of the work of composing Web pages, pre-rendering and pre-fetching content, and squeezing the size of page components, a way, claimed Amazon, to speed up browsing on low-powered devices like the Kindle Fire.

Source….

Hackers Attempt To Access AT&T Mobile

AT&T Inc, the No. 2 U.S. wireless carrier, said it is investigating an “organized and systemic attempt” to access mobile customers’ information but that it did not believe any accounts were breached.

The company, which had 100 million subscribers at the end of the third quarter, said it is advising less than 1 percent of its wireless customers that there was an attempt to obtain information about their accounts.

It said that the parties involved appeared to have used “auto script” technology to see if AT&T telephone numbers were linked to online AT&T accounts.

Spokesman Mark Siegel said AT&T’s “investigation is ongoing to determine the source or intent of the attempt to gather this information.”

.

Source…

Qualcomm Releases New S4 Processors

Qualcomm has announced a slew of Krait-based Snapdragon system-on-chips (SoC) processors to fit in its S1 and S4 performance classes.

Qualcomm’s Snapdragon range of SoC chips have proven to be extremely popular in smartphones and tablets, however the firm is facing a growing challenge from Texas Instruments and Nvidia. Coming little over a week after Nvidia revealed its quad-core Tegra 3 processor, Qualcomm has announced eight Snapdragon S4 processors and four Snapdragon S1 processors.

Since Qualcomm showed off the Krait architecture in February with three chips, the firm has not extended its headline S4 range of processors. Now it has added eight SKUs, with models including the MSM8660A, MSM8260A, MSM8630, MSM8230, MSM8627, MSM8227, APQ8060A and APQ8030. Qualcomm was cagey about when devices sporting these chips will appear, only mentioning an early 2012 timeframe.

Perhaps more important for Qualcomm’s sales figures are its entry level Snapdragon S1 chips. The four new chips in this category are the MSM7225A, MSM7625A, MSM7227A and MSM7627A models, with the firm claiming that they have been optimised for those OEM customers that are making the transition from 2G to 3G devices.

Source….

Apple Has A Hole In MAC OS X

Apple has failed to fix a bug in its Mac OS X operating system that allows processes to bypass the sandbox protection in place.

The flaw was discovered by Anibal Sacco and Matias Eissler from Core Security Technologies. They let Apple know about the problem on 20 September, and while Apple acknowledged their submission, it said that it did not see any security threat, forcing the Core Security Technologies team to publish the report to the public this month.

The problem appears to be with the use of Apple events in several default profiles, including the no-network and no-internet ones. When Apple events are dispatched a process can escape the sandbox, which could be exploited by hackers.

The vulnerability could lead to a compromised application restricted by the use of the no-network profile gaining access to network resources through the use of Apple events to execute other applications that are not restricted by the sandbox, making it a significant security threat.

Only the more recent versions of Mac OS X are vulnerable to this bug, including 10.5.x, 10.6.x, and 10.7.x. Those using 10.4.x are safe from the exploit.

Source…

Comcast Starts IPv6 Network Rollout

Comcast has begun the production rollout of its new IPv6 service, with 100 customers upgraded in San Francisco’s East Bay in one week.

IPv6 is an upgrade to the Internet’s main communications protocol, which is called IPv4. IPv6 features an expanded addressing scheme that can support billions of devices connected directly to the Internet at faster speeds and lower cost than IPv4, which is running out of addresses.

Comcast began an IPv6 trial 18 months ago and is a leader in the deployment of IPv6-based services among U.S. ISPs.

The production rollout began on Oct. 31. It offers customers “native dual-stack service,” which means Comcast is supporting both IPv6 and IPv4 services.

The initial subscribers of Comcast’s production-quality IPv6 service have stand-alone computers running Microsoft Windows 7, Windows Vista or Apple Mac OS X that are connected directly to a Comcast cable modem. Comcast plans to support IPv6 for customers with home routers at a later date.

Source

AMD To Slash A 10th Of Its Workforce

Advanced Micro Devices Inc revealed a plan on Thursday to save about $200 million of operating costs in 2012 by cutting 10 percent of its global workforce and streamlining internal business processes.

The layoffs mark the first major move by Chief Executive Rory Read, who took the helm in August to try to galvanize a microprocessor maker that has bled market share to larger rival Intel Corp, while missing out on the mobile device boom.

“It’s not too surprising given the operating background of the new CEO and this is exactly what you’d bring an outsider in to do, but their problems go far deeper right now,” said Alex Gauna, an analyst at JMP Securities.

The layoffs should be completed in 2012′s first quarter, AMD said in a statement. Savings generated could help bankroll research and expansion into areas such as low-power chips, emerging markets and cloud computing next year.

In late September AMD, a distant second to Intel in selling microprocessors that are the brains of PCs, warned of manufacturing problems manufacturing it new 32 nanometer Llano chips as well as older 45 nanometer chips.

Source….

Want A $19/Month Mobile Plan?

A new wireless operator is gearing up to launch next week with plans offering unlimited data, voice and texting for $19 a month and no contract.

Republic Wireless, a division of Bandwith.com, will provide the service through Voice over IP using the nearest available Wi-Fi hotspot starting Tuesday, Nov. 8, a spokesman confirmed via email.

When a wireless phone user is traveling, the service will be provided through traditional cellular connections, initially over the Sprint network.

One important catch: Republic will require that its users have a new Android-based smartphone equipped with hardware and software that supports automatic switching from Wi-Fi to cellular. The device must have single phone number that works on both networks.

Republic hasn’t disclosed further details on phones the network will support. The company said more details will be made available on the launch date.

Republic calls its Wi-Fi and cellular mixture “Hybrid Calling,” a strategy it said reduces the costs for network services and makes the $19 flat monthly “membership” rate possible.

Republic estimates that smartphone users are within reach of Wi-Fi over 60% of the time, said the spokesman, Kevin LaHaise.

Source….

Judge Oks Sprint’s Lawsuit Against AT&T

A judge in the U.S. on Wednesday gave the go ahead to parts of C Spire Wireless and Sprint Nextel’s lawsuits against AT&T’s proposed US$39 billion acquisition of T-Mobile USA.

AT&T and T-Mobile had moved for dismissal of the lawsuits arguing that the complaints by Sprint and C Spire, formerly Cellular South, failed to adequately substantiate that the merger would cause them “antitrust injury”.

The decision by District Judge Ellen Segal Huvelle of the United States District Court for the District of Columbia could complicate AT&T’s defense of the deal which has been already opposed by the U.S. government.

The U.S. Department of Justice filed a lawsuit in August to block AT&T from acquiring T-Mobile, saying that the deal would significantly reduce competition, increase prices and stifle innovation. Seven state attorneys general have joined the lawsuit. That case goes on trial in February before Judge Huvelle.

Where private plaintiffs have successfully pleaded antitrust injury, the fact that they are defendants’ competitors is no bar, Judge Huvelle said before allowing Sprint and C Spire to proceed with their claim that the merger would make it difficult for them to acquire wireless devices. The companies had claimed that after the merger AT&T and Verizon would be in a better position to get exclusive handset deals, while foreclosing their access to the most innovative handsets and raise their costs.

Source…

« Previous Page — Next Page »