Technology News You Can Use

[iridium]

Here's a motocycle chase.

But the reason to post is the technology of the Helicopter Cam...

My first time seeing real-time overlays of street names and even property lines via a mobile camera...


Obviously, Skynet will have no problem picking us off...

That is just not fair. In my young days, I would only haul-ass when I was near woods that I could deeply disappear into along small paths.

iridium

 

[Fitzcaraldo215]

Pretty interesting development in security world. For a while now researchers/hackers have been examining subcomponents in computers/phones that heretofore have thought to be just pieces of hardware with no vulnerability. Op to now the focus has always been to break the operating system and have it do something on behalf of a third party. This latest breach however, successfully goes after a WiFi controller inside countless iPhones and Android phones by Broadcom (leader in wireless silicon such as Wifi and Bluetooth).

Like many subcomponents these days, processors have been put in them which execute software. By examining the leaked source code for this processor, a bug was found that allows the capability to make it do anything from another Wifi device. The last step of causing the WiFi controller to control the operating system was not done but it seems pretty feasible.

FYI there are even attempts to go after mundane things like the analog digital converter which exist in every phone and computer! The idea would be through radio frequencies to cause it to do things it would normally not do. One example would be to create an audio sequence that triggers a bug in some audio player and with it, take control of the machine. No longer would you click on an audio file sent to you to take over your machine! This is one is long ways from being there but the level of scrutiny of computer/phone components is unprecedented. And is taking the manufacturers of these components by surprise because they have not had to worry about such things before.

Make sure you update your phones. My update from Samsung came yesterday for my S8+. Be sure to do this as I am sure countless hackers are going after this now they know it can be done.

-------

https://www.wired.com/story/broadpwn-wi-fi-vulnerability-ios-android/

IF YOU HAVEN'T updated your iPhone or Android device lately, do it now. Until very recent patches, a bug in a little-examined Wi-Fi chip would have allowed a hacker to invisibly hack into any one of a billion devices. Yes, billion with a b.

[...]

Over the last weeks, both Google and Apple have rushed to patch that bug, which Artenstein calls Broadpwn. Without that fix, it would have allowed a hacker who comes within Wi-Fi range of a target not only to hack a victim's phone, but even to turn it into a rogue access point that would in turn infect nearby phones, quickly spreading from one device to the next in what Artenstein describes as the first Wi-Fi worm.

[...]

Broadpwn
Artenstein, a researcher for the security firm Exodus Intelligence, says he has suspected for years that Broadcom's Wi-Fi chip might offer new avenues into the guts of a smartphone. After all, the "kernel" of a modern phone—the core of its operating system—is now protected by measures like address space layout randomization, which randomizes code's location in memory to prevent a hacker from being able to exploit it, and data execution prevention, which prevents hackers from planting malicious commands in data to trick a computer into running them. They're locked down tight.

But Broadcom's Wi-Fi controllers have no such protections. And they're found across manufacturers and operating systems, from the latest Samsung Galaxy devices to every single iPhone. "Obviously, this is a much more interesting attack surface," Artenstein said in his Black Hat talk. "You don’t have to repeat your work. If you find one bug, you can use it plenty of places."

So about a year ago, Artenstein began the painstaking process of reverse-engineering the obscure firmware of Broadcom's chips. He was aided, he says, by an unexpected leak of the company's source code he found on Github, which Artenstein suspects was accidentally published by one of Broadcom's partners. And as he dug through the code, he quickly found opportunities for trouble. "If you look at these systems you find bugs like you used to in the good old days," Artenstein said.

He eventually spotted one crucial bug in particular, hidden in Broadcom's "association" process, which allows phones to search for familiar Wi-Fi networks before they connect to one. One part of the beginning of that handshake process didn't properly constrict a piece of data sent to it by the Wi-Fi access point back to the chip, a bug known as a "heap overflow." With a carefully crafted response, the access point could send data that corrupts the module's memory, overflowing into other parts of the memory to run as commands.

"You malform it in a special way that gives you the power to write anywhere in memory," Artenstein explains. That sort of overflow is vastly harder to exploit when a hacker is remotely attacking randomized, protected memory of modern operating systems, but worked perfectly in the memory of Broadcom's Wi-Fi module on smartphones. "It’s a pretty special bug," Artenstein says.

Because the flaw existed in the part of the Broadcom code that handles automatic communications between the phone and an access point, the entire process of taking over a Wi-Fi chip could occur without the user noticing anything at all amiss. To make matters worse, the attack could repurpose Wi-Fi chip as an access point itself, broadcasting the same attack to any vulnerable phones within range to exponentially spread through the smartphone world.

Artenstein notes, however, that he didn't go so far as to write the part of the attack that would spread from the Wi-Fi chip to the phone's kernel, though he believes that final step would be possible for motivated hackers. "For a real attacker with resources, it would not be an issue," Artenstein says.

Google pushed out an update for Android phones in early July, and Apple followed with an iOS fix last week, well before Artenstein revealed the full details of his findings in a blog post Wednesday.

Gosh, thanks, Amir, but I am still using a Nokia Windows phone. Just, kidding. My now Stone Age Samsung Galaxy 4 mini does all that I want. And, in an Otterbox case, it is going to last another decade.

Do Ubers come any quicker when you page them on your phone? I don't think so.

 

[amirm]

I had to upgrade to be able to cover audio shows! Performing song lookups was so power hungry on my Samsung Note 4. I bought a spare battery and that would barely get me through a single day. The new S8 is about 3 to 4 times more power efficient so now I don't have to watch the gauge all the time.

While performance is better, it was not a major factor for upgrading. That said, this thing is so fast and smooth.

 

[The Smokester]

I had to upgrade to be able to cover audio shows! Performing song lookups was so power hungry on my Samsung Note 4. I bought a spare battery and that would barely get me through a single day. The new S8 is about 3 to 4 times more power efficient so now I don't have to watch the gauge all the time.

While performance is better, it was not a major factor for upgrading. That said, this thing is so fast and smooth.

How's the S8 as a phone? I have a Motor Z Force and when in a weak reception area it is outperformed by other phones (like the latest iPhone).

 

[amirm]

How's the S8 as a phone? I have a Motor Z Force and when in a weak reception area it is outperformed by other phones (like the latest iPhone).

It is excellent in every manner. Audio fidelity for phone is the best I have head and it beats my wife's (3-4 year old) Motorola in reception. We have a drop out area on the way home and this is the only phone that survives that segment and keeps the calls and internet data going. The display is gorgeous and speed and fluidity with which it scrolls it is a delight. Wireless charging is fast (using a fast charger) and activates more reliably than my previous phones. The narrow design makes it pretty comfortable to hold and carry. It also runs cool no matter what is going on in there.

The downside is the back glass which makes it prone to breakage and slippery which increases those odds. So for the first time I got a case for it. It is made out of a sticky plastic that solves both problems. No replaceable battery either so it has limited lifetime by design.

The other negative bit which is common to many Android phones is amount of stuff put in there that you need to take the time to customize. It usually takes me a week to silence everything that wants to beep at me, deal with pushy messages to sign up for this and that (did sign up for smart phone caller ID which flags spam/fraud), etc.

As I mentioned, I went in there due to necessity of battery life and nothing else but after purchasing the phone, I am quite delighted and will likely get one for my wife to replace her Moto.

 

[Thomas savage]

It is excellent in every manner. Audio fidelity for phone is the best I have head and it beats my wife's (3-4 year old) Motorola in reception. We have a drop out area on the way home and this is the only phone that survives that segment and keeps the calls and internet data going. The display is gorgeous and speed and fluidity with which it scrolls it is a delight. Wireless charging is fast (using a fast charger) and activates more reliably than my previous phones. The narrow design makes it pretty comfortable to hold and carry. It also runs cool no matter what is going on in there.

The downside is the back glass which makes it prone to breakage and slippery which increases those odds. So for the first time I got a case for it. It is made out of a sticky plastic that solves both problems. No replaceable battery either so it has limited lifetime by design.

The other negative bit which is common to many Android phones is amount of stuff put in there that you need to take the time to customize. It usually takes me a week to silence everything that wants to beep at me, deal with pushy messages to sign up for this and that (did sign up for smart phone caller ID which flags spam/fraud), etc.

As I mentioned, I went in there due to necessity of battery life and nothing else but after purchasing the phone, I am quite delighted and will likely get one for my wife to replace her Moto.

I want a replacement for my S5 so will get one of these, thanks mate .

 

[The Smokester]

Looks like they are taking action though: https://teslamotorsclub.com/tmc/thr...acement-part-delays.87179/page-4#post-2004525

I just wanted to point out the evolution of the above-referenced teslamotorsclub thread since the mid-March post:

I know one of the posters. As of mid July 2017, Tesla's repair problems still persist. First problem is that most motorists don't carry enough insurance to repair a $100k car so lawyers get involved. Then, because Tesla (still) has a parts shortage, the repair will often take months during which you will be paying for, but unable to use, your $100k car. Even the most generous rental car reimbursements will run out and the availability of a modest Merc or Jag rental is not the equivalent of a Tesla. Then there is the availability of authorized and capable repair shops which, in Marin County, California, are slammed. My friend's Model S has been chasing other Tesla's on and off the repair rack as they find parts they thought they had in hand turn out to be defective. Then there is the issue of "diminished" value which can be blown-off for a regular car but becomes significant for a $100k car...Another legal hassle.

Not all of this is in Tesla's control, but they are exacerbating the conditions for disaffection.

PS I know. I know. First world problem. But, Musk points out that the success of the new Model 3 depends on the market viability of their luxury models and electric cars are a component in his vision for a cleaner planet.

 

[Don Hills]

... The other negative bit which is common to many Android phones is amount of stuff put in there that you need to take the time to customize. ...

My children both have Moto G4, because (in this market at least) they come "bare" - no bloatware.

 

[The Smokester]

My children both have Moto G4, because (in this market at least) they come "bare" - no bloatware.

Yes. That was the original Moto experience...almost pure Android. But I need to stop dropping calls.

 

[amirm]

The brains behind a lot of "smart" devices is full blown operating systems. This gives them instant access to networking capabilities such as accessing the Internet and support for tons of peripherals "for free." Alas, these operating system (commonly Linux) are under constant attacks. The version used in computers is routinely patched. But companies using them in these "embedded" applications routinely fail to do so and as a result, they are sitting there, ready to be attacked. Such is the case with Tesla Model S car.

https://www.pcmag.com/news/355281/tesla-model-s-hackers-return-for-encore-attack
Tesla Model S Hackers Return for Encore Attack
A year after successfully hacking the Tesla Model S, the same team repeats their success at the Black Hat conference.

With a handful of self-driving vehicles already on the road, the car is poised to be the next vanguard for high technology. And Tesla's all-electric vehicles are among the most advanced consumer vehicles on the road.

At Black Hat 2016, researchers from Tencent KeenLab demonstrated how to remotely take control of a Tesla Model S. Tesla quickly patched those vulnerabilities, but the Tencent team returned to Black Hat 2017 with a new slew of Tesla attacks.

Roll Back

During their Black Hat session, researchers Ling Liu, Sen Nie, and Yuefeng Du explained last year's Tesla hack in detail. Critical to attacking the Model S was the onboard Wi-Fi and 3G radios.

The Wi-Fi in the Model S tries to reconnect with known networks. That's true—and not great security—for many devices, but all Tesla vehicles are exposed to the same Wi-Fi network during construction, which has an easily guessed password. From there, the team attacked the vehicle's built-in browser, which they admitted was harder than expected because Tesla had already patched known vulnerabilties.

With a handful of self-driving vehicles already on the road, the car is poised to be the next vanguard for high technology. And Tesla's all-electric vehicles are among the most advanced consumer vehicles on the road.

At Black Hat 2016, researchers from Tencent KeenLab demonstrated how to remotely take control of a Tesla Model S. Tesla quickly patched those vulnerabilities, but the Tencent team returned to Black Hat 2017 with a new slew of Tesla attacks.

Roll Back

During their Black Hat session, researchers Ling Liu, Sen Nie, and Yuefeng Du explained last year's Tesla hack in detail. Critical to attacking the Model S was the onboard Wi-Fi and 3G radios.

The Wi-Fi in the Model S tries to reconnect with known networks. That's true—and not great security—for many devices, but all Tesla vehicles are exposed to the same Wi-Fi network during construction, which has an easily guessed password. From there, the team attacked the vehicle's built-in browser, which they admitted was harder than expected because Tesla had already patched known vulnerabilties.

Using some JavaScript magic, the team elevated the privilege to the top (root) level, attacked the old, out-of-date kernel [operating system], bypassed a firmware integrity check, and finally installed their own firmware on the gateway system. Once under their control, this critical system was the jumping-off point for the team's work in the Model S. With this level of control, the team could perform dangerous actions even when the car was in motion. Notably, the team also found attack vectors allowing them to gain access through the car's 3G radio.

But this is Black Hat. The team told the audience that shortly after the Tesla rolled out the new kernel, they found a zero-day vulnerability that allowed them to completely bypass the new code-signing mechanism.

In a video demonstration (above), the team showed how they were able to use an app to open the doors and trunks of two vehicles. They even demonstrated how they could engage the brakes while the car was in motion, with a Tesla stopping just short of two of the researchers.

But the researchers said they believed hacking should be fun, which is why their grand finale was a syncronized light show using the Tesla's exterior lighting systems synched to music. Flashing patterns covered the vehicle, withe the lights clearly operating in a way not intended by the manufacturer. The gull-wing doors even opened and bobbed up and down like rhythmic rabbit years. A member of the research team told the audience that making this light show work properly was very difficult, and required all of the vulnerabilities they had found.


Not quite the tired hoody-and-sunglasses approach to hacking, but definitely a memorable attack.

 

[NorthSky]

◙ AMD's Vega Graphics Cards Could Kick Off a War

 

[amirm]

Thanks Bob. It seems that AMD had been sleep at the helm forever. Now they are finally there with their CPUs and GPU. Love to have the competition and choices.

 

[The Smokester]

...But the researchers said they believed hacking should be fun, which is why their grand finale was a syncronized light show using the Tesla's exterior lighting systems synched to music. Flashing patterns covered the vehicle, withe the lights clearly operating in a way not intended by the manufacturer. The gull-wing doors even opened and bobbed up and down like rhythmic rabbit years...

Hahahaha!

Showed this to my Tesla owner friend. She was not amused.

 

[The Smokester]

It is excellent in every manner. Audio fidelity for phone is the best I have head and it beats my wife's (3-4 year old) Motorola in reception. We have a drop out area on the way home and this is the only phone that survives that segment and keeps the calls and internet data going. The display is gorgeous and speed and fluidity with which it scrolls it is a delight. Wireless charging is fast (using a fast charger) and activates more reliably than my previous phones. The narrow design makes it pretty comfortable to hold and carry. It also runs cool no matter what is going on in there...

Bought an S8+ two weeks ago. Solved my dropped call problem. It is everything you say.

 

[amirm]

Bought an S8+ two weeks ago. Solved my dropped call problem. It is everything you say.

Excellent!

 

[amirm]

Can't come soon enough: https://www.engadget.com/2017/08/25/google-chrome-keep-websites-muted/

A member of Google's Chrome development team announced today that it's working on a mute button for websites. In a post, François Beaufort said, "This will give you more control about which website is allowed to throw sound at you automatically."

Chrome already lets you mute tabs, but once you leave the site you've muted, the setting is undone. This option would let you mute websites for repeated visits until you decide to unmute them. You can try the feature out in Chrome's experimental Canary version by clicking on the "Secure" button to the left of the address bar and turning off the sound toggle in the page info menu that pops up.

Apple is also working on a function that would keep unwanted sound from automatic videos in check. For its upcoming High Sierra desktop OS, the updated Safari browser will give users the option to keep auto-play videos paused until they decide they want them to play.

----

They also need a way to stop auto-start html video pages. Can't stand going to a site and have it play videos. All the news sites do this now and it is a super pain.

 

[Old Listener]

Can't come soon enough: https://www.engadget.com/2017/08/25/google-chrome-keep-websites-muted/

A member of Google's Chrome development team announced today that it's working on a mute button for websites. In a post, François Beaufort said, "This will give you more control about which website is allowed to throw sound at you automatically."

Chrome already lets you mute tabs, but once you leave the site you've muted, the setting is undone. This option would let you mute websites for repeated visits until you decide to unmute them. You can try the feature out in Chrome's experimental Canary version by clicking on the "Secure" button to the left of the address bar and turning off the sound toggle in the page info menu that pops up.

Apple is also working on a function that would keep unwanted sound from automatic videos in check. For its upcoming High Sierra desktop OS, the updated Safari browser will give users the option to keep auto-play videos paused until they decide they want them to play.

----

They also need a way to stop auto-start html video pages. Can't stand going to a site and have it play videos. All the news sites do this now and it is a super pain.

I agree that better browser support for silencing unwanted browser audio is badly needed.

I had to re-configure audio on my home office PC. I now keep an audio cable plugged into the motherboard audio 3.5mm socket. That cable isn't plugged into anything at the other end but Windows recognizes it as an audio playback device. I keep it as the default device until I want to hear a video. Then I switch the default device to be the one actually connected to my speakers. After use, I switch the default device back to motherboard audio (if I remember.) Cumbersome and irritating.

One particularly nasty trick many web pages play is to adjust the volume on the default audio output device which unmutes the device.

 

[Sal1950]

They also need a way to stop auto-start html video pages. Can't stand going to a site and have it play videos. All the news sites do this now and it is a super pain.

One particularly nasty trick many web pages play is to adjust the volume on the default audio output device which unmutes the device.

Totally agreed.
Can't think of a more agravating recent development than sites having videos or sound in general start the minute they open.
Great new browser feature to be able control this.

 

[amirm]

I still remember how big of a day it was when 1 gigabyte compact flash cards became available for digital cameras. Paid $950 for it I think. Now here we are with 400 gigabyte with tiny microSD cards which I prefer to use as I can instantly load them on laptop without messing with CF readers. They of course also fit directly on phones that allow them (think Samsung and not Apple). And they only cost $249. https://www.pcmag.com/news/355930/sandisk-sets-new-record-with-400gb-microsd-card

The SanDisk Ultra MicroSD UHS-I 400GB card is Class 10 rated and offers transfer speeds of up to 100MB/s. SanDisk believes it's the perfect card for Android smartphones and tablets, and is capable of transferring up to 1,200 photos in a minute. If video is more your thing, then this giant card will hold up to 40 hours of HD quality video.

In November last year, the SD Association introduced Application Performance Classes for SD cards as part of the SD Specification 5.1. Cards already carry a Class rating, but that only guarantees a minimum sequential write speed. The new Application Performance Classes extends that to guarantee read and write Input-Output access Per Second (IOPS) performance, too.

This 400GB SanDisk card carries the A1 Application Performance rating, meaning as well as guaranteeing at least 10MB/s writes, the card achieves random read IOPS of 1,500, and write IOPS of 500. In other words, it's a great card for loading your apps quickly.

 

[RayDunzl]

Wondering how they fit 400,000,000,000 bytes (3,200,000,000,000 bits) into something so small as a MicroSD...

Found they stack smaller memories inside: