Apple Blasted For Not Blocking Stolen Certificates

A security researcher blasted Apple for what he called “foot dragging” over the DigiNotar certificate fiasco, and urged the company to act fast to update Mac OS X to protect users.

“We’re looking at some very serious issues [about trust on the Web] and it doesn’t help matters when Apple is dragging its feet,” said Paul Henry, a security and forensics analyst with Arizona-based Lumension.

Unlike Microsoft, which updated Windows Tuesday to block all SSL (secure socket layer) certificates issued by DigiNotar, Apple has not updated Mac OS X to do the same.

DigiNotar, one of hundreds of firms authorized to issue digital certificates that authenticate a website’s identity, admitted on Aug. 30 that its servers were compromised weeks earlier. A report made public Monday said that hackers had acquired 531 certificates, including many used by the Dutch government, and that DigiNotar was unaware of the intrusion for weeks.

Because almost all the people who were routed to a site secured with one of the stolen certificates were from Iran, many experts suspect that the DigiNotar hack was sponsored or encouraged by the Iranian government, which could use them to spy on its citizens.

Microsoft isn’t the only software maker to block all DigiNotar certificates: Google, Mozilla and Opera have also issued new versions of their browsers — Chrome, Firefox and Opera — to completely, or in Opera’s case, partially prevent users from reaching websites secured with a DigiNotar certificate.

Users of Safari on Mac OS X, however, remain at risk to possible “man-in-the-middle” attacks based on the fraudulently obtained certificates.

Because Safari relies on the underlying operating system to tell it which certificates have been revoked or banned entirely, Apple must update Mac OS X. The Windows edition of Safari, which has a negligible share of the browser market, taps Windows’ certificate list: That version is safe to use once Microsoft’s Tuesday patch is applied.

Read More….

Microsoft: Stolen SSL Certs No Good

Microsoft has officially stated that a digital certificate stolen from a Dutch company could not be used to force-feed customers malware through its Windows Update service.

The company’s assertion came after a massive theft of more than 500 SSL (secure socket layer) certificates, including several that could be used to impersonate Microsoft’s update services, was revealed by Dutch authorities and several other affected developers.

“Attackers are not able to leverage a fraudulent Windows Update certificate to install malware via the Windows Update servers,” said Jonathan Ness, an engineer with the Microsoft Security Response Center (MSRC), in a Sunday blog post. “The Windows Update client will only install binary payloads signed by the actual Microsoft root certificate, which is issued
and secured by Microsoft.”

Seven of the 531 certificates now known to have been fraudulently obtained by hackers in July were for the domains update.microsoft.com and windowsupdate.com, while another six were for *.microsoft.com.

Read More…..

Dell & Baidu To Create Mobile Devices

Dell Inc and China’s top search engine Baidu Inc plan to join forces and develop tablet computers and mobile phones, targeting the Chinese market dominated by Apple Inc and Lenovo.

China is one of the fastest growing markets for tablets and is home to more than 900 million cell phone subscribers, but analysts were skeptical that the partnership would knock Apple from its dominant perch in the market.

“I suspect this is just Dell, who has a lot of problems on the mobile and tablet front, grasping at straws to get any kind of publicity that it can to make its product more attractive,” said Michael Clendenin, managing director of technology consultancy RedTech Advisors.

“Ultimately in China, I still think it is Apple’s game, still for the iPad and iPhone.”

Dell declined to give a timeline for the launch of the devices, but local media reported on Tuesday, quoting sources, that it may be as early as November.

Baidu launched a new mobile application platform last week and offered a glimpse of its upcoming mobile operating system, which it hopes will serve a growing number of users accessing the Internet from smartphones and tablet computers.

Read More….

Lofty Wishes: AT&T To Offer $700 HTC 4G Tablet

AT&T on Wednesday announced the new HTC Jetstream, its first LTE-ready tablet, will become available on Sept. 4 for $700 and a two-year contract.

Jetstream’s price may be too steep for many customers, even with a fast LTE plus HSPA+ connection, given expected lower prices for tablets on the horizon. Amazon is expected to unveil a 9-in. tablet soon priced at $299, while Hewlett-Packard has begun a $99 fire sale for its soon-to-be-defunct TouchPad.

The 10.1-in. Jetstream runs Android 3.1 with an expandable storage capacity of 32 GB, but at nearly $700, it would be $100 more than the 32 GB Apple iPad 2 with its 9.7-in. screen.

That premium price for the Jetstream seems to based principally on its fast LTE (Long-Term Evolution) connection and a digital pen input capability that allows for drawings and signatures on the touchscreen.

Read More…

The Linux Kernel Got Hacked

Servers that are part of the Linux kernel.org infrastructure were affected during a recent intrusion where attackers managed to gain root access and plant Trojan scripts.

According to an email sent out to the community by kernel.org chief administrator John Hawley, known as warthog9, the incident started with the compromise of a server referred to as Hera. The personal colocated machine of Linux developer H Peter Anvin (HPA) and additional kernel.org systems were also affected.

“Upon some investigation there are a couple of kernel.org boxes, specifically hera and odin1, with potential pre-cursors on demeter2, zeus1 and zeus2, that have been hit by this,” Hawley wrote.

The intrusion was discovered on 28 August and according to preliminary findings attackers gained access by using a set of compromised credentials. They then elevated their privileges to root by exploiting a zero-day vulnerability that the kernel.org administrators have yet to identify.

Fortunately, logs and parts of the exploit code were retained and will help the investigation. A Trojan was added to the startup scripts of affected systems, but gave itself away through Xnest /dev/mem error messages.

According to the kernel.org admins, these error messages have been seen on other systems as well, but it’s not clear if those machines are vulnerable or compromised. “If developers see this, and you don’t have Xnest installed, please investigate,” the administrators advised.

The good news is that the exploit failed on systems running the latest Linux kernel version, 3.1-rc2, which was released two weeks ago. This is possibly the fortunate consequence of one of the bugfixes it contains.

Read More…

Sprint To Be The First To Offer Galaxy S II

Sprint will be the first U.S. mobile carrier to offer Samsung’s Galaxy S II, starting Sept. 16, but T-Mobile and AT&T said Tuesday they also will sell the phone.

A follow-on to the popular Galaxy S, the phone will be the thinnest available at all three operators.

The largest mobile carrier in the U.S., Verizon Wireless, notably has decided not to sell the phone. Verizon recently said it already has an extensive portfolio of Android phones and so would not offer the Galaxy S II.

All models of the Galaxy S II will work on the 4G networks of the respective operators and will run Android 2.3, or Gingerbread. The phone will have a 4.3-inch Super Amoled Plus display, which uses technology developed by Samsung. It will have an 8-megapixel rear camera, plus a 2-megapixel front-facing camera for video conferencing.

Read More…

Will HP Temporarily Resurrects The TouchPad?

Hewlett Packard Co plans to produce “one last run” of TouchPads, days after declaring it will discontinue a line of tablets that failed to challenge Apple Inc’s domination of the booming market.

A day after the chief of HP’s personal devices division told Reuters the TouchPad might get a second lease on life, HP announced a temporary about-face on the gadget after being “pleasantly surprised” by the outsized demand generated by a weekend fire-sale.

HP slashed the price of its tablet to $99 from $399 and $499 the weekend after announcing the TouchPad’s demise on August 18, part of a raft of decisions intended to move HP away from the consumer and focus on enterprise clientele.

That ignited an online frenzy and long lines at retailers as bargain-hunters chased down a gadget that had been on store shelves just six weeks.

“The speed at which it disappeared from inventory has been stunning,” the company said. “We have decided to produce one last run of TouchPads to meet unfulfilled demand.”

HP may lose money on every TouchPad in its final production run. According to IHS iSuppli’s preliminary estimates, the 32GB version carries a bill of materials of $318.

“We don’t know exactly when these units will be available or how many we’ll get, and we can’t promise we’ll have enough for everyone. We do know that it will be at least a few weeks before you can purchase,” HP said in a blogpost.

Read More….

Radio Antennas Made Fashionable

Ohio State University researchers armed with sewing machines and computers have designed a way to weave radio antennas into clothing in an effort to give wearers more flexible and reliable communications capabilities.

Utilizing plastic film and metallic thread, the researchers are attempting to outfit American soldiers with better and less intrusive wireless technology, though they say the hands-free design could be applicable to others, including police, firefighters and the elderly.

The researchers outline their antenna design in the journal IEEE Antennas and Wireless Propagation Letters. They acknowledge the concept of wearable antennas isn’t new (combine what they’re doing and some of the invisibility cloak designs that would be woven into clothing and you’d really have something!).

But the OSU researchers claim their design is an improvement over past efforts in that it boosts antenna range fourfold by utilizing a computer controller that fits on a belt and works with multiple antennas that can send and receive signals in all directions. Network coding that coordinates communications among antennas also plays a key role.

Read More….

Lenovo Tablet Hits The Market

Lenovo’s business-oriented tablet, the ThinkPad Tablet, is now available for purchase and should start shipping within a week. The 10-inch Android device, which Lenovo officially announced a little more than a month ago, boasts an impressive mix of consumer and business-friendly features that might please both the user and their IT department.

Like other Android 3.1 Honeycomb tablets on the market, the ThinkPad Tablet has a 1280 x 800 multitouch display, 1GB of memory, front- and rear-facing cameras and a NVIDIA Tegra 2 dual core processor. It comes in a 16GB model for $499, a 32GB version for $569 and a 64GB option for $669. Basic specs and price-wise, the ThinkPad Tablet is on par with the competition.

What sets the ThinkPad apart, however, are the enterprise-oriented tools like remote administration in case the tablet gets lost or stolen, support for Cisco VPN, and full device encryption. Free apps included like Documents to Go, PrinterShare, and Computrace underscore the tablets professional target audience.

Read More….

Dish Seeks To Add Cellular Services

Satellite TV provider Dish Network is aiming to build a 4G cellular network, if the U.S. Federal Communications Commission grants its permission, according to a filing the satellite provider made on Monday.

Dish, which earlier this year completed an acquisition of bankrupt satellite mobile operator TerreStar, asked the FCC to transfer TerreStar’s frequency licenses to a Dish subsidiary and to allow Dish to use the spectrum to build a broadband wireless network that it could then use to offer standalone cellular services.

Combined with spectrum Dish acquired in a separate deal to buy DBSD North America, the satellite provider wants to build a network using LTE, the technology of choice for most of the nationwide mobile phone operators, it wrote.

But it needs special permission from the FCC to offer standalone cellular service–as opposed to a service that is integrated with satellite service–and says it is crucial that it be allowed to do so.

“The requirement to make every device dual-mode severely limits a provider’s ability to enter into arrangements with multiple device and equipment manufacturers, thereby limiting consumer choice and severely impairing the business case economics,” Dish wrote.

The company also argued that customers want the choice of a smaller, lighter device with long battery life. Adding satellite capabilities to devices makes them heavier and reduces battery life. “Today, a mobile voice and data provider’s ability to attract customers depends in large measure on its ability to provide its customers with the types of devices that best suit their needs,” it wrote.

Read More….

« Previous Page — Next Page »