Lest you think Facebook is the only security punching bag getting a beating lately, two significant flaws in the Android application platform have been revealed by overseas security teams. Without going into the gory details, each team has found a different way to create a trojanized APK (the file format in which Android apps are delivered) that is indistinguishable from the original. This would allow an app to appear and function normally, but also execute functions like transmitting your passwords, texts, emails on the sly. Google has already put together a fix and distributed a patch to OEM manufacturers, and supposedly they are able to detect this sort of exploit on the Google Play Store.
You need to worry if you “sideload” apps on your Android phone, which is to say you get apps from sources other than Google Play. Keep in mind, even Amazon’s App store counts as a sideloading source, and as of the moment, they aren’t scanning for this vulnerability.
What this means for you:
Even though Google has issued a fix for this particular vulnerability, they can’t force the update upon the millions of Android phones out there affected by this weakness, as that task lies with the phone manufacturers and the carriers. With the exception of avid power-users, most Android users are unaware that their Android OS may be months or years out of date, primarily because cellular carriers insist on selling phones that use a modified version of the OS that does not automatically get updated when Google updates the core version of Android. On top of this, the carriers are notoriously slow in issuing updates. If you are wondering what folks are talking about when they are discussing “Gingerbread”, “Honeycomb”, “Ice Cream Sandwich” and “Jelly Bean”, they are referring to the various versions of Android OS, where Jelly Bean is the latest. Supposedly this exploit exists as far back as “Donut” (ver 1.6).
Even worse, certain older models of Android phones may never get updated, as the carrier has essentially abandoned firmware updates for phones that are “retired” from active support. Users of these phones have essentially two options: root, unlock and update the phone with a custom version of the Android OS developed by the open source community, or buy a new phone. The former option is definitely not for technically-disinclined. Given the gravity of the vulnerability, the carriers may issue patches for the majority of its phones, but I wouldn’t hold your breath.
Until you are able to verify your Android smartphone is running a version of the OS that fixes this vulnerability, don’t sideload applications. If you want to be extra safe, avoid using smartphone apps that transmit sensitive information like banking passwords, pins and other sensitive personal information. As I’ve reiterated before, exercise caution before convenience, especially when it comes to protecting yourself.
Apple officially announced the next version of their mobile device operating system at the Worldwide Developer Conference on June 10th. The rumors of a redesigned interface proved to be true, as iOS 7 showed off a completely reskinned interface that features a more muted color scheme with “flattened” elements, a marked departure from the infamous “lickable” buttons and widgets of previous iterations. The new look was also backed by many updates to interface mechanics, expanded multitasking, redesigns of some of the built-in apps, and the launch of Apple’s own streaming music service, a direct competitor of similar services like Spotify, Pandora, and Google’s Music All Access.
What this means for you:
If you have an iPhone 4 or iPad 2 or newer, then the OS update will be automatically pushed out to you when it is released this Fall. Aside from the new look, iPhone users will enjoy the new “control center” function – a slide-up widget that allows you to access commonly used iPhone settings like toggles for Wifi, Bluetooth, Airplane Mode. The expanded multi-tasking capabilities will now grant the ability to all apps to work in the background (iOS 6 restricted this capability to a handful Apple apps only) without significant drains on the battery, so content-based apps can grab content as it becomes available (push-based) versus when requested by the user (pull-based).
If you are an Android user, you may be scratching your head and wondering why it’s taken Apple so long to bring features like the above to the iPhone. To be fair, Apple has been focusing their energy on a foolproof OS, which sometimes means making compromises on capabilities, but with an eroding marketshare and Samsung hot on their heels, the gloves have come off in the smartphone wars. For a full list of features, you can visit Apple’s iOS 7 website.
Proving that sometimes our Congress people come by their paychecks honestly, a bi-partisan privacy caucus led by Joe Barton (Rep. TX) sent a list of questions to Google’s CEO Larry Page, asking him point blank about several privacy issues, including whether or not Google would allow the use of facial recognition technology on the device.
Supposedly, Google has maintained from the start that facial recognition would never be implemented without “strong privacy protections in place.” In a Google+ post Friday, they reiterated this position and stated that Google “…won’t be approving any facial recognition Glassware at this time.”
What this means for you:
By default, Android OS-based devices can only install software via Google’s Play store. Software distributed via Play must go through Google’s approval process, much like apps on Apple’s iTunes store, so you can assume that Google will be true to their word and prevent distribution of facial recognition apps simply by not approving them. However, unlike iPhones, many versions of Android allow “sideloading” of apps with a simple settings change. Sideloading in the Android ecosystem is well established – Amazon.com has an app store that requires sideloading to be enabled, and instructions for enabling this capability are easily found on their website and many, many others.
Bottom line: this is yet another Pandora’s box that won’t be closed. Facial recognition is a reality, and portable, undetectable devices capable of performing this function are only a step away from today’s consumer technology. Technology (and scientific progress in general) advances despite legal or cultural ramifications. One could argue that society only advances in light of controversial technologies like Google Glass. We are only beginning to glimpse the potential of an always connected and much less private world. Google Glass is only one step in a long, uphill climb.
The controversial CISPA (Cyber Intelligence Sharing and Protection Act) proposal has passed committee review and is heading to the Senate for a vote, despite a clear warning from the Obama administration that it would VETO the proposed law. Unlike the equally controversial SOPA (Stop Online Piracy Act) backed by media companies and defeated through vigorous and coordinated protests from the technology industry, CISPA has divided the technology industry. Many large companies like IBM, AT&T, Oracle and Verizon backing it, while other, equally sizeable companies like Facebook, Microsoft, Google and dozens of activist organizations oppose the bill on the grounds that it doesn’t do enough to protect the privacy of US citizens.
What this means for you:
In case you are confused as to how CISPA might impact you or your business personally, here’s a summation of what the bill proposes: This law would allow telecommunication companies to share data with governmental agencies for the purposes of combatting terrorist or criminal activity, overriding any local laws that would prohibit such sharing. According to supporters, law-abiding citizens should have nothing to worry about, but opponents contend that on top of very weak protections for citizen privacy, there is nothing in the bill that would protect citizens from potential abuse by the various intelligence agencies who could amass an inconceivably comprehensive database from the information gained by CISPA. Regardless of which side of the privacy fight you stand on, it behooves you as a US citizen to be aware of where you stand on this issue, as well as encouraging everyone around you to participate as they can in helping our government come to terms with this problem.
Image courtesy of Stuart Miles / FreeDigitalPhotos.net
Apple has joined the growing ranks of digital services enabling two-factor authentication as a means to protect their customers from account theft. Two-factor authentication has long been a staple of secure corporate and government networks, and employs a basic mechanic of password plus a randomly-generated authentication code that is delivered to a device that you must have in your possession at the time of authentication. In the past, this device has traditionally taken the form of keychain fobs and cards whose sole purpose was to generate numeric keys constantly, but this same functionality can now be delivered through apps that are installable on smartphones, via SMS message to registered cell phones, or even via automated voice calls to your home or office phone.
What this means for you:
In Apple’s case (as with services like Gmail, Facebook, and many massive, multiplayer online games like World of Warcraft), two-factor authentication is an opt-in service, and is not enabled by default with your Apple ID/iTunes account. Enabling the extra security requires you register one or more cell phones with Apple that will receive your authentication code via SMS. Should you do this? If you use services that require an AppleID (iTunes, iCloud, Mac.com, etc.) with any frequency, and especially if you have iTunes credit banked, you should absolutely enable two-factor authentication, especially if the account is tied to a core service you rely on, such as a Mac.com email address, or iCloud for your iPhone and other Apple devices. Two-factor security makes your AppleID (or any other account like Gmail, etc.) that much harder to hack. There will be some inconvenience, especially if you are in a hurry to access your account and have to hassle with the extra security code entry, but imagine the alternative if your account is hacked.
With greater security comes less convenience, a fact of life in this digital age, and not something that will change in the foreseeable future without a significant evolution in security technology.
Image courtesy of Stuart Miles / FreeDigitalPhotos.net
In what many analysts are seeing as another setback for beleaguered BlackBerry, the US Department of Defense has now announced that it will start allowing the use of iPhones and Android devices in a space that was once the domain of BlackBerry devices. In the early days of mobile email delivery, BlackBerry devices were designed for enterprise-controlled security, where as the other email-capable devices still relied on immature internet standards, or like Apple’s early iPhones, completely eschewed corporate control. Because of this, BlackBerry became the defacto standard for any business that valued security over style, including pretty much every government agency around the world.
What this means for you:
Don’t count BlackBerry out just yet, but the count is getting shorter and shorter, and at some point the referree might need to stop the fight. The Pentagon isn’t getting rid of BlackBerries (that would be a haymaker they won’t get up from), but they are now opening up the space for departments to use solutions from other vendors (namely Apple and Android). This is a signal to the rest of the world that might have been sceptical of iOS or Android’s security status that if the world’s most powerful military is willing to consider using iPhones and Androids, maybe those platforms have finally caught (and passed) BlackBerry on the security front.
Industry analysts are taking off their rose-colored glasses after examining the results of BlackBerry’s largely lackluster launch of their OS 10 platform. Original estimates had the newly renamed company (formerly Research In Motion) selling as many as 1.75 million new phones following the Jan 30 debut. Using words like “soft launch” and “modest demand”, analysts are now revising their estimates down by as much as 83%, putting BlackBerry’s comeback into serious doubt.
What this means for you:
It’s probably too early to call it, but BlackBerry really needed a big splash with the 10 launch and to keep surging forward with momentum to stay on par with upcoming anticipated Samsung and Apple launches on tap for Summer. Early reviews indicate that version 10 phones have caught up with the competition, but the technology hasn’t leapfrogged the competition, something BlackBerry really needs to do to gain any footing in this market, as they can’t outspend Google, Apple or even Samsung. If your company is heavily invested in BlackBerry and still supports it for corporate communications, you can’t go wrong with a Z10 or Q10, as long as your IT department has committed to keeping their BB infrastructure current. If they seem even the littlest bit wishy-washy on that subject, or they already support Android and iOS devices, you’ll make a safer investment in another platform.
Microsoft is (re)launching Outlook.com and consolidating its various “free” email service domains under the Outlook.com brand in an effort to regain the former glory it once held with Hotmail.com which has since fallen to a distant third behind Google’s Gmail and Yahoo Mail. Microsoft estimates it will be spending anywhere from $30 to $90 million in marketing in all the major media over the next 3 months on a combination of attack ads aimed at Gmail users as well as informational campaigns they hope will help persuade users to switch (back, in many cases) to Microsoft.
What this means for you:
If you already have a Hotmail.com or MSN.com email address and you haven’t already converted over, you’ll be migrated over to Outlook.com gradually as Microsoft consolidates the services under the new brand. If you are considering switching (or opening another webmail account), the only feature Outlook.com is offering that differs from the competition is Contacts stored in your online address book will automatically update information based upon information available on social media platforms like Facebook, Twitter and LinkedIn. Gmail does this with G+ but you have to resort to third-party extensions and services to mine the other social media sites for this information. Beyond this feature, Outlook.com is mostly playing catch-up to Gmail, though their marketing dollars may steal some of Yahoo’s marketshare despite the company’s revamp of its webmail service a little over a year ago.
According to The Verge, Google notified Microsoft of its plans to discontinue support for ActiveSync on the Gmail platform last year, and has recently notified Microsoft that the cut-off is coming on Jan 30, despite Microsoft’s efforts to get a 6-month extension from Google. ActiveSync is widely used to sync calendar and contact data from Gmail to Windows and iOS devices. Microsoft has noted that the Windows Phone OS will support CardDAV and CalDAV, which are the protocols used currently for synching on Android devices, in a future update of Windows Phone OS, but the update release data has not been announced yet.
What this means for you:
If you use Gmail as your primary calendar and contact management system, and you are syncing contacts and calendar data to a Windows Phone or an iPhone, you will lose the ability to sync up your data between phone and the cloud for an unknown length of time once Google drops support for ActiveSync – Gizmodo projects it could be as long as six months time. If you need this functionality, start considering alternatives ASAP!
Research In Motion (RIM), makers of the once-dominant BlackBerry platform, has announced the launch date of its BlackBerry 10 phones to be January 30 by all the major US carriers except Sprint, who has promised a BB10 phone later in the year. Many analysts believe that this launch is the last-ditch effort by RIM to regain relevance in an industry dominated by iPhone and Android devices, and just as many have already counted them out.
What this means for you:
If you are one of the dwindling BlackBerry faithful, there is a lot to whet your (by now, monstrous) appetite: the new RIM OS modern look and all new code-base (supposedly no carry-over code from older RIM OS’s) will hopefully update BlackBerry’s staid, corporate image. However, the new BB10 phones have multiple strikes against them:
- Developers for the “staple” apps (Facebook, Google, Netflix, etc) will undoubtedly develop versions of their omnipresent apps because they can fund the development off the backs of their profitable iOS and Android counterparts, but don’t expect surprise hits from indie developers appearing on BB10 first – there just isn’t a large enough userbase to warrant the investment gamble. RIM has sponsored some recent events to kickstart development, but proof will be in whether BB10’s launch will be a repeat of Microsoft’s Windows Phone lackluster debut.
- BlackBerry’s current infrastructure has some serious redudancy flaws that has led to some titanic outages. Once viewed as the most reliable platform in the early days of smartphones, the series of recent, widespread outages has severely tarnished RIM’s image.
- RIM has been lapped by Apple and Google, OS-wise, at least 2 to 3 times now. RIM is just launching a competitor to phone OS’s that were developed years ago. Unless this horse can fly, there is no way BB10 is catching iOS6 or Jelly Bean in this race.
I suspect that RIM isn’t quite done – they still have a nice chunk of the market, but they aren’t going to supplant iPhones or Androids anytime soon.