In 2012, Massachusetts passed a law forcing automotive companies to share diagnostic information with third party repair shops. The law set a precedent and the industry rolled out the changes nationally. Now, Massachusetts has commissioned a study to see if similar legislation should extend to consumer electronics such as smartphones and video game consoles.
Source: This 17-Year-Old Has Become Michigan’s Leading Right to Repair Advocate – Motherboard
“On default, Alexa ends the sessions after each duration… we were able to build in a feature that kept the session going [so Alexa would continue listening]. We also wanted to make sure that the user is not prompted and that Alexa is still listening without re-prompts,” Erez Yalon, manager of Application Security Research at Checkmarx, told Threatpost.
That’s a myth. While slowdowns happen, they take place for a far less nefarious reason. That reason is a software upgrade.
Source: A New Phone Comes Out. Yours Slows Down. A Conspiracy? No. – The New York Times
“Everybody I know in the cryptocurrency space has gotten their phone number stolen,” said Joby Weeks, a Bitcoin entrepreneur.
Source: Identity Thieves Hijack Cellphone Accounts to Go After Virtual Currency – The New York Times
Soon after its release, electronics insurance company SquareTrade put Samsung’s new flagship phone through its breakability test, a series of drops, dunks, and tumbles. It was deemed the most breakable phone of all time: “S8 is the first phone we’ve tested that’s cracked on the first drop on ALL sides,” SquareTrade wrote in a video demonstrating the drops.
Source: Repair Shops Are Stoked That the Samsung Galaxy S8 Is the Most Fragile Phone Ever Made – Motherboard
According to Scheel, the problem is that the HbbTV standard, carried by DVB-T signals and supported by all smart TVS, allows the sending of commands that tell smart TVs to access and load a website in the background.
Knowing this, Scheel developed two exploits he hosted on his own website, which when loaded in the TV’s built-in browser would execute malicious code, gain root access, and effectively take over the device.
Source: About 90% of Smart TVs Vulnerable to Remote Hacking via Rogue TV Signals
One of those holes is that Galaxy S8’s face recognition can be tricked with a photo. At least this is what a video from Spanish Periscope user Marcianophone purports.
Source: Galaxy S8 face recognition already defeated with a simple picture | Ars Technica
During setup the app instructs the user to either plug in an Ethernet cable or press the ‘pair’ button on the camera which causes the camera to switch to host mode and offer up an open (aka insecure) wireless network. The app then scans for this network which is typically called CameraHD-(MAC address) and prompts the user to connect to it. This is an alarming feature for a camera designed for outdoor use particularly as the camera also offers a host of unfiltered network services, including the network video feed (RTSP), a bespoke internal messaging service for initiating alerts and two distinct web servers (nuvoton and busybox), one of which has an undocumented firmware upgrade page. Readers of our other blogs will know how much we like upgrading firmware…
Earlier this year, G Data contemporary Marble Security found a fake, pre-installed version of Netflix had been stealing personal data from several smartphone models, including the Samsung Galaxy range and the LG Nexus, and transmitting its swag to a server in Russia.
The spyware is delivered either via the aforementioned app, or via an SMS or email that contain a specially crafted URL that will trigger exploits for several vulnerabilities in the default browsers of Android versions 4.0 Ice Cream Sandwich to 4.3 Jelly Bean.
This will allow the attacker to gain root privilege, and allow the installation of a shell backdoor and RCS Android.
Source: Hacking Team’s RCS Android: The most sophisticated Android malware ever exposed