LG G3 'Snap' vulnerability leaves owners at risk of data theft

Security researchers have discovered a vulnerability in LG G3 smartphones which could be exploited to run arbitrary JavaScript to steal data. The issue has been named Snap, and was discovered by Israeli security firms BugSec and Cynet.

What is particularly concerning about Snap is that it affects the Smart Notice which is installed on all LG G3s by default. By embedding malicious script in a contact, it is possible to use WebView to run server side code via JavaScript. If exploited, the vulnerability could be used to gather information from SD cards, steal data from the likes of WhatsApp, and steal private photos.

Researchers identified a number of possible attack vectors, including asking a victim to scan a QR code, or sending a fake contact via WhatsApp or MMS. Liran Segal and Shachar Korot, who discovered the vulnerability, say they contacted LG and the company responded quickly by updating Smart Notice with a patch. The onus is on G3 owners to install the update

In a blog post, Cynet says:

The root cause for the security problem is the fact that Smart Notice does not validate the data presented to the users. Data can be taken from the phone contacts and manipulated. The attack can take place in several ways due to functionality issues of the Smart Notice application. The application pops notifications (named 'cards') in each of these scenarios:

• Favorite contact notification – Recommends you keep in touch with favorite contacts.

• New contact suggestion – Suggests saving a caller number.

• Callback reminder – Reminder to callback a contact after declining the call.

• Birthday notification – Reminder about contact birthday.

• Memo reminder – Provides notifications about user memos.

The video below from BugSec Group shows how the vulnerability can be exploited:

Adobe pushes out betas for version 21 of Flash and Air

Lots of things are said about Flash, and most of them aren't good. The Adobe app has proven to be a security nightmare and constant updates do little to alleviate the problems. Now a new version is on its way and hoping to fix things.

New versions of Flash 21 and Air 21 are in the works, currently these products are codenamed "Sutter". Don't expect any major changes, the company points out it's just incremental advances.

"This beta release includes new features as well as enhancements and bug fixes related to security, stability, performance, and device compatibility for Flash Player 21 and AIR 21", the software maker announces.

Both are being released by Adobe Labs, meaning they are a bit experimental, so you may experience some issues in using them. Likely you won't but that caveat needs to be pointed out, as it does with all beta software.

You can grab the updates from the following links:

Download Adobe AIR 21 beta

Download Flash Player 21 beta

Adobe concludes that "As always, we appreciate all feedback. We encourage you to post in our beta forums or create bug reports or feature requests on our public bug database".

Why did Google give $6,006.13 to MBA candidate Sanmay Ved?

Google's security bounty programs can be quite lucrative for those who discover problems, and the company has just published a report looking back at the security landscape in 2015. Entitled Google Security Rewards - 2015 Year in Review, the report reveals the financial rewards that have been paid out in the last 12 months.

In all, Google has paid out more than $2 million to more than 300 people, but Sanmay Ved is probably one of the more interesting reward recipients. He's the guy who -- very briefly -- managed to buy Google.com before having it taken off his hands. Google offered him a $6,006.13 reward, but there's a little more to the story.

If you're wondering about the slightly strange amount, Google explains that if you squint and use a little imagination, the figure spells out the word Google. Sanmay decided to donate his reward to charity, and when Google learned about this, the reward was doubled. While Sanmay may have been one of the more unusual reward recipients, Tomasz Bojarski got the crown for the most prolific, discovering no fewer than 70 bugs on Google.

2015 was the year that Android was added to the to the Security Reward program initiative resulting in payments of over $200,000 to researchers. Google shares a graphic that shows some of the highlights from 2015:

In 2015, Google's Vulnerability Research Grants was used to provide researchers with the funds they need to carry out their work. One example of how these funds were used includes research into a YouTube problem:

We’ve already seen positive results from this program; here’s one example. Kamil Histamullin a researcher from Kasan, Russia received a VRP grant early last year. Shortly thereafter, he found an issue in YouTube Creator Studio which would have enabled anyone to delete any video from YouTube by simply changing a parameter from the URL. After the issue was reported, our teams quickly fixed it and the researcher was rewarded $5,000 in addition to his initial research grant. Kamil detailed his findings on his personal blog in March.

Find out more about Google's reward programs over on the Google Security blog.

Photo Credit: tanuha2001 / Shutterstock.com

'Alexa, turn on kitchen lights': Setting up Cree bulbs with Amazon Echo and Wink hub

"Alexa, turn on the lights". This is a phrase echoed, apparently, by more people than I thought. Amazon's Echo is taking hold and seems especially popular with those interested in the home automation side of technology. Voice control can be both good and bad, though. It's great when it works, but embarrassing and frustrating when it doesn't.

Let's start with the bad, though really it's just the amusing. My Amazon Echo is in my living room, as is the TV. Words emitting from my surround sound system can sometimes have hilarious results -- music suddenly beginning to play, Alexa telling me she doesn't understand the question, and if an ad for Echo comes on then things go nuts.

With all of that said, the device is very good. It makes a great speaker -- it plays music while I work, it gives me sports and weather updates as well.

But one area Amazon really seems to want to move into is home automation -- the smart home, the Internet of Things, whatever you wish to call it. Companies are increasingly coming on board to work with Alexa and allow voice control of all sorts of products. All it takes is a hub and several are already operational with it.

A while back I wrote about  setting up the Wink hub with Echo and then using it to control my living room lights which I outfitted with GE Link bulbs. Now I am once again using the Wink hub but this time to control Cree bulbs in my kitchen. The process is pretty much the same, but we'll walk through it once more, as both apps have updated since the last time, so a bit is different.

So here are the steps. It's fairly simple, but not necessarily intuitive.

1: Install the bulbs and connect hub.

2: Install the Wink app on your phone or tablet -- Android or iPhone (sorry Windows Phone)

3: Open the app and click menu at the top left.

4: You need to let the app discover and add the lights and also name them -- naming is important. The app will walk you through the steps. Be sure the lights are turned off when you start.

5: Create a group and add the lights to it, then give the group a name.

6: Test this by turning off one bulb at a time and also the entire group at once. Just tap each bulb and then switch to the group view and tap its name ("Kitchen" in this case).

7: Open the Alexa app on your device.

8: Click Menu > Settings > Connected Home.

9: Click "Discover new products". The app should find your bulbs in 15-20 seconds (the Wink app can take much longer).

10: Click "Create group", name it and check the boxes next to your bulbs then save it.

11: Now test Alexa -- "Alexa, turn on/off kitchen".

Things should be all up and running for you now. If you have a problem then verify the steps. At worst you can always call Wink or Amazon, both have excellent customer service.

Act now! You only have this weekend to save your free OneDrive storage before Microsoft takes it away for good

Free online storage space is something many of us really appreciate. Quotas are usually so generous that’s there’s rarely a need to spend money on a paid subscription.

However, Microsoft recently announced plans to cut back on the amount of free storage offered to OneDrive users. As a recap, the base storage will drop from 15GB to 5GB, the 15 GB camera roll storage bonus is being discontinued, Office 365 Home, Personal, or University users will no longer get unlimited storage, and some paid tiers are going away also.

After an outcry from disappointed OneDrive users, Microsoft backtracked and permitted users with 15GB of OneDrive space to keep their base storage quota and camera roll bonus, even after the changes roll out. There is a catch though.

This is an opt-in offer with a time limit and you need to act before the end of January 31 to secure your free storage. Delay, and it will be gone for good.

The good news is saving your space is incredibly easy. All you have to do is go here and click the "Keep your free storage" button. That’s it.

So what are you waiting for? Go do it now before you forget and it's too late.

Facebook bans private gun sales -- no, that doesn't violate your 2nd Amendment rights

While many people view Second Amendment defenders as gun nuts, the truth is, that isn't always the case. A good example? Me. While I am a life member of the NRA, firearms don't really thrill me. No, I get my jollies from computers and technology. My interest in Second Amendment protection is mostly constitutional -- I don't want to see any of my fellow American's rights get trampled.

Today, Facebook announces that it is banning private gun sales on its site. Of course, some folks will see this as an attack on the Second Amendment, and maybe even the First Amendment. The truth of the matter is, neither your freedom of speech nor your right to bear arms are impacted by Facebook's decision. Why? Because the social network is not a public or government place. Facebook has the right to determine its own policies.

I reached out to Facebook for more information. A spokesperson for the company told me the following.

Today we are updating our policies for managing regulated goods to prohibit people from using Facebook to offer and coordinate private sales of firearms. This policy already prohibits people from offering marijuana, pharmaceuticals, and illegal drugs for sale.

The updated policy aligns more closely with our policies around commerce and advertising, which place similar restrictions on advertisements of regulated goods including pharmaceuticals, illegal drugs, and firearms.

This policy update focuses on private or 'peer-to-peer' sales of weapons, not weapons that are being sold in stores or off Facebook through online, licensed retailers. Licensed firearm retailers will still be able to post about their goods and services on Facebook while completing sales transactions off Facebook.

We have systems in place to review and remove content that violates our terms of service and advertising that is false, deceptive, or misleading.

There you go folks, only peer-to-peer sales are impacted by this decision. This means licensed businesses can continue to leverage the social network to advertise firearms. Heck, individuals can still post pictures of themselves with guns, discuss guns, and even post videos of themselves at a shooting range.

Quite frankly, this is a smart and responsible move on Facebook's part. There has been a lot of gun violence lately, and private sales on the site could elude police or other investigators. Will the private sales ban stop all gun violence? No. But at least it means one less way for bad guys to purchase guns under the radar.

Job well done, Facebook.

Photo credit: JPL Designs / Shutterstock

Why your business should consider outsourcing

Technology tethered with innovation drives business, it determines how successful your business can be and ensures that you maintain your standing in the market. It plays a huge role in your businesses growth, it demands that you constantly improve upon yourself and it enables your business to reach its potential.

In more ways than can be explained, a synergistic effect of technology coupled with innovation will assure your survival. If you lag behind you risk losing your market share and thus a slow and steady path towards decline takes over.

Considering its advantages, most organizations today opt for an outsourced-based model for IT or will bring on board a third party cloud partner to provide managed cloud hosting. What is important to understand is that even though there are a lot of positives, firms tend to outsource this prime function mainly because of its negative impact.

The one which has everyone going is the fact that it’s expensive to maintain, it’s investment driven and can have a considerable impact on the bottom line of your business. On the one hand it encourages you to upgrade, on the other it bleeds your cash flows dry.

However when all is said and done, outsourcing IT-based functions or cloud computing is also beneficial for a completely different reason as well. It allows the business to breathe, when you have a third party vendor taking care of your requirements and building capacity at their end to fulfill your demands, then what you get to focus on are elements which really drive revenue.

Factors such as costs which relate to licensing of software or the maintenance of hardware can be put towards other important aspects. Similarly, no matter how good you are at what you do, you still won’t be able to develop a support system on an as and when basis. Firms which are experts in their fields will take over complete operational management of your requirements and will run a mile to offer support at any time.

Bluewire Solutions specializes in tailoring enterprise-class managed systems and services.

Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.

Photo Credit: Tashatuvango/Shutterstock