TMO Link

Link

Wink: Give Us $5 Monthly Or Lose Access to Your Devices

Andrew Orr ·

Wink is a company that makes smart home devices, and it recently announced it will force customers to pay a US$5/month subscription or they will lose access to device functionality.

In order to provide for development and continued growth, we are transitioning to a $4.99 monthly subscription, starting on May 13, 2020. This fee is designed to be as modest as possible […] Should you choose not to sign up for a subscription you will no longer be able to access your Wink devices from the app, with voice control or through the API, and your automations will be disabled on May 13. Your device connections, settings and automations can be reactivated if you decide to subscribe at a later date.

1: I think that’s called extortion, or fraud at the very least. 2: Apparently Wink is owned by will.i.am of The Black Eyed Peas, and has trouble paying its employees. Not that it’s relevant, I just haven’t heard either of those names in years.

Link

Lazarus Group’s Dacls RAT Affects Macs for the First Time

Andrew Orr ·

Security researcher Patrick Wardle writes that the Lazarus group’s RAT malware has been targeting macOS for the first time. MalwareBytes also published a report (and the source of my quote below). It was found to be distributed with a two-factor authentication app called MinaOTP, commonly used by Chinese users.

We believe this Mac variant of the Dcals RAT is associated with the Lazarus group, also known as Hidden Cobra and APT 38, an infamous North Korean threat actor performing cyber espionage and cyber-crime operations since 2009.

The group is known to be one of the most sophisticated actors, capable of making custom malware to target different platforms. The discovery of this Mac RAT shows that this APT group is constantly developing its malware toolset.

The conclusion I’m drawing is that it’s unlikely to affect most Mac users.

Link

Spotify CEO Says Apple Will Open its Platform More

Andrew Orr ·

In an interview with Bloomberg TV, Spotify CEO Daniel Ek says he expects Apple to open its platform more to third party services.

“Long term, we do expect Apple to open up,” Ek said in an interview with Bloomberg TV that aired on Tuesday. Spotify has criticized Apple for taking a 30% cut of subscriptions and accused it of limiting app updates and preventing functionality on the Apple Watch and Siri.

Spotify will only be satisfied with the cancellation of Apple Music and the preinstallation of its app on iOS. But that still wouldn’t change the fact that it doesn’t pay artists a fair wage.

Link

Hacker Bribed Roblox Insider to Access Kids’ Data

Andrew Orr ·

Motherboard reports that a hacker had bribed a Roblox insider to access the data of over 100 million users.

“I did this only to prove a point to them,” the hacker told Motherboard in an online chat. Motherboard granted the hacker anonymity to speak more candidly about a criminal incident.

Beyond just viewing user data, the hacker was able to reset passwords and change user data too […] The hacker said they changed the password for two accounts and sold their items. One of the screenshots appears to show the successful change of two-factor authentication settings […]

Proving a point my a**. This person tried to claim a bug bounty from Roblox. They denied it because he/she acted “more maliciously than a legitimate security researcher.” He messed with the accounts after denial, so his point was revenge.

Update: A Roblox spokesperson informed me that only a small amount of customers were affected, not 100 million, and immediate action was taken to address the issue. Additionally, it was a Roblox insider and not an employee.

Link

Firefox 76 Improves Built-In Password Manager

Andrew Orr ·

Mozilla released Firefox 76 today, bringing improvements to the browser’s Lockwise password manager. It also gives Mac users picture-in-picture functionality.

Firefox Lockwise will require a device’s account password before allowing a saved password to be copied, and it will let users know if a website breach has occurred that compromises a login and password.

It also provides an alert for vulnerable passwords, which are passwords used for more than one site. The password generating feature that creates random passwords has also been rolled out to more sites.

That’s great to know. I had no idea Firefox had a built-in PM.

Link

France Claims Apple is Undermining its COVID App Efforts

Andrew Orr ·

On Tuesday the French government accused Apple of undermining its efforts with its contact tracing app “StopCovid.”

Apple’s iPhones normally block access to Bluetooth unless the user is actively running an app. French officials want Apple to change the settings to let their app access Bluetooth in the background, so it is always on. So far, they say, Apple has refused.

O, the French minister, said he could not explain the reasoning behind Apple’s decision on Bluetooth. “We consider that oversight of the healthcare system, fighting the coronavirus, is a matter for governments and not necessarily for big American companies,” he said.

As we pointed out on our Daily Observations podcast, most people aren’t going to care about the privacy aspects of these apps. But they will care about battery life, and apps like these constantly using Bluetooth in the background will undoubtedly be a factor, Bluetooth Low Energy or not.

Link

This Pandemic Gives More Power to Big Tech

Andrew Orr ·

Kara Swisher wrote for The New York Times about how this pandemic will put even more power into the collective hands of Big Tech companies.

Now, as we turn to the healthy companies to help us revive the economy, it could be that the only ones with real immunity are the tech giants. In this way, Covid-19 has accelerated their rise and tightened their grip on our lives. And this consolidation of power, combined with Big Tech’s control of data, automation, robotics, artificial intelligence, media, advertising, retail and even autonomous tech, is daunting.

This has been my fear as well. What happens to all the small businesses unable to loans from the government and money from customers? They get swallowed by delivery apps, whether it’s for groceries, alcohol, or other goods.

Link

You Can Now Lock Google Drive on iOS With Face ID, Touch ID

Andrew Orr ·

Today Google updated Google Drive on iOS with a feature called Privacy Screen. It lets you lock the app with Face ID and Touch ID. Digital Trends notes:

The feature is activated each time you close the Drive app and reopen it and also locks files if you switch between Google Drive and another app, according to a Google spokesperson. You’ll have the option to turn this feature on and adjust its timing in Drive settings.

I personally would like Apple to let us lock every app with Face ID / Touch ID. Apps can clearly do this by themselves, but having it “baked” into the operating system is ideal.

App Store: Google Drive – Free

Link

Backblaze S3 Compatible APIs are Here for B2 Cloud Storage

Andrew Orr ·

Today Backblaze announced it supports S3 compatible APIs for its B2 cloud storage service. This means that developers and software companies can use Backblaze storage without having to rewrite code or change their workflows.

Official Launch Partners: Cinnafilm, IBM Aspera, Igneous, LucidLink, Marquis, Masstech, Primestream, Quantum, Scale Logic, Storage Made Easy, Studio Network Solutions, Veeam, Venera, Vidispine, Xendata. These companies join a list of more than 100 other software, hardware, and cloud companies already offering Backblaze B2 to support their customers’ cloud storage needs.

Link

Senators Introduce COVID-19 Consumer Data Protection Act

Andrew Orr ·

Today a group of Republican senators announced plans to introduce the COVID-19 Consumer Data Protection Act.

The legislation would provide all Americans with more transparency, choice, and control over the collection and use of their personal health, geolocation, and proximity data. The bill would also hold businesses accountable to consumers if they use personal data to fight the COVID-19 pandemic.

A good move, I think. We need thoughtful legislation passed to preempt the contact tracing train.

Link

SteamVR Drops Support for Mac Customers

Andrew Orr ·

Steam announced today that SteamVR is dropping support for macOS so the team can focus on Windows and Linux.

We recommend that macOS users continue to opt into the SteamVR [macos]branches for access to legacy builds.

Users can opt into a branch by right-clicking on SteamVR in Steam, and selecting Properties… -> Betas.

SteamVR first came to the Mac in 2017 when Apple added support for external GPUs. They’re most likely reacting to a lack of interest on the part of users and a lack of commitment on Apple’s part.

Link

The ORG Domain Won’t Be Sold to a Private Entity After All

Andrew Orr ·

The board of the Internet Association for Assigned Names and Numbers (ICAAN) has rejected the sale of the Public Interest Registry to private equity firm Ethos.

Since 2003, PIR has operated the .ORG generic top-level domain (gTLD) as a not-for-profit organization, as well as six other gTLDs. Per the gTLD Registry Agreements, ICANN must either approve or withhold consent of a proposed change of control, the deadline for which is 4 May 2020.

After completing its evaluation, the ICANN Board finds that the public interest is better served in withholding consent as a result of various factors that create unacceptable uncertainty over the future of the third largest gTLD registry.

Good news for public organizations with .ORG websites. We don’t need another private company jacking up prices.

Link

Get a Raspberry Pi Camera With This New $50 Product

Andrew Orr ·

The Raspberry Pi Foundation announced a camera board built around a 12MP Sony IMX477 sensor, and it supports interchangeable lenses.

The High Quality Camera is compatible with almost all Raspberry Pi models, from the original Raspberry Pi 1 Model B onward. Some very early Raspberry Pi Zero boards from the start of 2016 lack a camera connector, and other Zero users will need the same adapter FPC that is used with Camera Module v2.

Link

Apple Could Let You Edit iMessages in the Future

Andrew Orr ·

A patent filed in December reveals a method to let Apple customers edit iMessages as a method of correction. The edit history would also be available so everyone can see what the sender originally wrote.

The patent filing has an example to demonstrate Apple’s system for editing previously-sent texts. Two people are discussing a trip, and one of them accidentally writes and sends “Can I get a ridiculous up with you?”

They then press and hold on that text to bring up a windows with “Edit” as an option. They make the change so the text reads “Can I get a ride up with you?”

This is a great feature and I hope Apple adds it to iOS. Memojis and Animojis are fun, but Messages needs features like this that are actually useful to people.

Link

Cellebrite Pitches its iPhone Hacking Tools as COVID-19 Surveillance Solution

Andrew Orr ·

Cellebrite, a company known for its iPhone hacking tools, is pitching its products to governments as a surveillance alternative to contact tracing.

When someone tests positive, authorities can siphon up the patient’s location data and contacts, making it easy to “quarantine the right people,” according to a Cellebrite email pitch to the Delhi police force this month.

This would usually be done with consent, the email said. But in legally justified cases, such as when a patient violates a law against public gatherings, police could use the tools to break into a confiscated device, Cellebrite advised.

I get the feeling that there are many who are unhappy that Apple and Google’s solution is private and opt-in. Companies like Cellebrite and Palantir can’t pass up such an opportunity.

Link

The Inside Story of How Apple and Google Worked on Contact Tracing

Andrew Orr ·

CNBC has a report today on how a small team at Apple started developing ideas on how to help with the pandemic. It was codenamed Project Bubble.

In mid-March, with Covid-19 spreading to almost every country in the world, a small team at Apple started brainstorming how they could help […] Within a few weeks, the Apple project — code-named “Bubble” — had dozens of employees working on it with executive-level support from two sponsors: Craig Federighi, a senior vice president of software engineering, and Jeff Williams, the company’s chief operating officer and de-facto head of healthcare.

It’s a fascinating read.

Link

Examining the iPhone SE Single Lens Camera

Andrew Orr ·

The team behind camera app Halide have taken a look at how well the iPhone SE can take Portrait Mode photos with a single lens camera.

The new iPhone SE can’t use focus pixels, because its older sensor doesn’t have enough coverage. Instead, it generates depth entirely through machine learning. It’s easy to test this yourself: take a picture of another picture.

A good write up, and interesting that it can do this purely with software, while the iPhone XR still had some hardware basis for these types of photos.

Link

8 Year Old Finds iPhone Screen Time Workaround

Andrew Orr ·

An eight year old has found an iPhone Screen Time workaround, after her older brother noticed something odd (His post on Reddit has since been deleted).

It turns out she’d developed a pretty simple trick to keep browsing videos: just access YouTube through the iMessage App Store…For example, the Reddit post specifies that the eight-year-old in question was unable to access YouTube on the iPhone’s Safari app or even in the iMessage version of YouTube. The kid had to go to some lengths to figure out that she could access YouTube by searching for it in the iMessage App Store.

She’s a security researcher in the making.

Link

Verizon Late Fees for Customers, Small Businesses Waived Until June 30

Andrew Orr ·

Verizon announced today that it won’t terminate service or charge late fees for customers through June 30.

Verizon today signed onto the FCC’s new “Keep Americans Connected” pledge. Verizon’s new customer commitment will help ensure connectivity and offer assistance to customers and small businesses facing challenges from the global crisis.

Good to know if you’re a Verizon customer.

Link

GDPR Hasn’t Been as Aggressive as Critics Would Like

Andrew Orr ·

Two years later, Europe’s General Data Protection Regulation has struggled with a lack of enforcement, not enough funding, limited staff resources, and stalling tactics by tech companies.

Privacy groups and smaller tech companies complain that companies like Facebook and Google are avoiding tough oversight. At the same time, the public’s experience with the G.D.P.R. has been a frustrating number of pop-up consent windows to click through when visiting a website.

I expected a lot more out of it as well. Sounds like the government needs to take it more seriously.

Link

Apple Disputes Zero Day Found in Apple Mail

Andrew Orr ·

Apple disagrees with a report from security company ZecOps that found an exploit that took advantage of the default iOS Mail app.

In the now-disputed report, ZecOps had said the critical flaw was located in the Mail app and could be triggered be sending specially manipulated emails that required no interaction on the part of users[…]

The critics said if the exploit was able to delete the emails ,it would have been able to delete the crash log data as well. The critics said that failure and some technical details contained in the ZecOps report strongly suggested the flaw was a more benign bug that was triggered by certain types of emails. Also skeptical, the critics said, is that an advanced exploit would cause a crash at all.

An interesting update to this saga. The bug certainly caused these devices to crash, but it remains to be seen whether that resulted in stolen data.

Link

Facebook Removes ‘Pseudoscience’ Category for Targeted Ads

Andrew Orr ·

Facebook is no longer allowing advertisers to use pseudoscience as a category with which to target people.

The company eliminated the pseudoscience category from its “detailed targeting” list on Wednesday, the spokeswoman said by phone, after tech news site The Markup showed that it could advertise a post targeting people interested in pseudoscience.

The Markup demonstrated that Facebook was allowing such ads after saying it would police COVID-19 misinformation on its platform. More than 78 million Facebook users were interested in “pseudoscience,” it said, citing Facebook’s ad portal.

Good to see Facebook doing this. Now we just need YouTube to stop recommending conspiracy videos.

Link

Netatmo Smart Indoor Security Camera Patched After Security Issue Found

Andrew Orr ·

Following an investigation by PCMag and Bitdefender, a patch has been issued for the Netatmo Smart Indoor Security Camera.

The Bitdefender IoT Vulnerability Research Team discovered that the device is susceptible to an authenticated file write that leads to command execution (CVE-2019-17101), as well as to a privilege escalation via dirtyc0w—a local privilege escalation bug that exploits a race condition in the implementation of the copy-on-write mechanism in the kernel’s memory-management subsystem.

Many smart home devices are notoriously insecure, and this is the main reason why I don’t have any of them (Besides my robot vacuum, but I explained my reasoning).

Link

Fortnite is Now in The Google Play Store, but Epic Games Isn't Happy About it

Charlotte Henry ·

After an 18-month standoff, Fortnite is finally on the Google Play Store. However, Techcrunch reported that gamesmaker Epic Games is not all that happy about it.

“Google puts software downloadable outside of Google Play at a disadvantage, through technical and business measures such as scary, repetitive security pop-ups for downloaded and updated software, restrictive manufacturer and carrier agreements and dealings, Google public relations characterizing third party software sources as malware, and new efforts such as Google Play Protect to outright block software obtained outside the Google Play store,” an Epic Games spokesperson said in a statement. “Because of this, we’ve launched Fortnite for Android on the Google Play Store.” Epic Games withholding Fortnite from the Play Store was a very clear threat to Google’s app profits, though Google argued that downloading Android software outside of the Play Store presented a clear security threat to users who could unknowingly download malware from less reputable sites.