Samsung Galaxy S3, S2 & HTC Android Phones are Vulnerable to 'remote wipe' Hack

Samsung Galaxy S3, S2 & HTC Android Phones are Vulnerable to 'remote wipe' Hack

Yet again a large number of Android users have been warned of a security hole. Security experts have uncovered that millions of Android handsets including the Samsung Galaxy S3, Galaxy S2, HTC One X and HTC Desire can be wiped just by visiting a malicious website that embeds particular code in weblinks. A user with a vulnerable handset who visits a page and clicks a link containing the malicious code would see their phone wiped, losing personal data such as photos and texts as well as repleaceable data such as contact details and apps. The flaw is caused by a security hole in some versions of Android's dialler software, which allows the "tel:" URL prefix to be used on a webpage to perform functions on the phone's dialling software. Normally that is useful for functions such as initiating a call on the handset directly from a site. But the tel: prefix can also be used to pass a string of non-numeric data to the dialler.

Special strings of characters can perform other functions; for example typing #06# on the dialler will display a phone's IMEI number. The flaw exploits a string that activates a factory reset of some phones because they do not force a user interaction before carrying out the function encoded in the string. The code would have to be embedded as a link to cause the user to activate it - but it would be easy to represent it as an innocent link to Google or any site. Pressing the link would initiate the wipe.

Users of vulnerable handsets may be able to install a third-party dialler and make that the default as protection against the "remote wipe" attack. Experts also pointed out that not all Android handsets have the capability for a remote wipe built in - although the number of models discovered with the vulnerability has grown since it became known on Tuesday.

Dylan Reeve, a New Zealand-based TV editor who first brought the flaw to wide notice, says that Samsung Galaxy phones which use Android 4.1 will be safe from the hack. But that still leaves millions of Galaxy S2 and some S3 models which will not have had the correct revision of the firmware rolled out to them and which could be hit.  

Though the vulnerability was fixed in Android's core code earlier this year, that code has not been propagated to every handset in use. The fact that the flaw existed in handsets from Samsung and HTC - the two biggest vendors of Android handsets - also suggests that a huge number of existing handsets could include the outdated code.

Samsung said in a statement that it has already provided a patch for the Galaxy S3, but it is not clear how long that will take for operator approval and rollout. In general software updates to any phone have to first be tested and approved by the carrier supporting the phone. Samsung said it is testing a patch for the Galaxy S2, but had no information on when it will be available or how it will be distributed. But HTC has issued a statement saying that "our devices do not support a USSD code to factory reset option." This means that they should not be vulnerable to the exploit described below.

-Source (Guardian)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Samsung Galaxy S3, S2 & HTC Android Phones are Vulnerable to 'remote wipe' Hack"https://www.voiceofgreyhat.com/2012/09/Samsung-Galaxy-HTC-Android-Phones-are-Vulnerable.html</a>

Android Vulnerability Assessment Tool Named WebContentResolver

WebContentResolver is an open source, Android assessment tool which allows you to find Content-Provider vulnerabilities desinged by MWR InfoSecurity Labs. Though it still is an Alpha release, you can atleast start and report any bugs that are found. 

What is an Android Content-Provider? 

A Content-Provider is one of Androids IPC endpoints; it is commonly used to implement data storage in applications and to offer access to this data to other applications on the device. They store,  add, alter, delete and retrieve data and make it accessible to all applications. They’re the only way to share data across applications as there is no common storage area that all Android packages can access. Android ships with a default number of content providers for common data types, such as – audio, video, images, personal contact information, browser bookmarks, contacts list, etc. It basically is an interface that clients use indirectly, most generally through ContentResolver objects. Unfortunately, because of unsupervised use, these Content-Providers are vulnerable which allow third party applications or compromised applications to gain access to sensitive data. Commong vulnerabilities, such as directory traversal or SQL injection in providers installed as part of the Android system or by third party applications are regularly found on the Android platform. As these issues are similar to issues that are commonly found in web applications it would be desirable to test Content-Providers in the same way web applications are tested using Android WebContentResolver. This allows us to leverage the current skill set of web application tester and the currently available tool set for web application testing.

WebContentResolver runs on an Android device or emulator and will offer a web service interface to all installed Content-Providers. This not only allows a security tester to use a web browser to test for vulnerabilities, but also to leverage the power of current web application testing tools, such as sqlmap, to find and exploit vulnerabilities in Content-Providers.

To Download WebContentResolver Click Here

Install the WebContentResolver.apk to the phone or emulator under test. This will create its icon in the Launcher menu, which we use to execute. This by default starts a local web server listening on port 8080.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Android Vulnerability Assessment Tool Named WebContentResolver"https://www.voiceofgreyhat.com/2011/12/android-vulnerability-assessment-tool.html</a>

VLC Media Player (Beta) for Android is Now Available

VLC is a popular media player for Windows, Mac and Linux computers. It was one of the first apps that could support virtually any video codec, which means that as long as you’re trying to watch a video without DRM, you can probably use VLC.
The developers have been working on an Android port of VLC for a while, and now it looks like we’re one step closer to a release. VLC for Android is now in beta testing, and you can sign up to request an invitation to participate in the private beta. There’s a key difference between VLC for desktop computers and for Android though. Most Android phones and tablets have processors that support hardware acceleration for just a few video codecs. So while VLC may be able to decode videos that aren’t supported by your device’s chipset, it will have to use software to do that, and the performance will likely vary from device to device and video file to video file.
For instance, most recent Android devices have hardware support for H.264 video files, which means you can typically play 720p or even 1080p HD video in that format on some devices. But it’s much less common (although not impossible) to find a device that has hardware support for MKV or DiVX video files. VLC may let you watch movies in those formats anyway, but I wouldn’t expect HD videos to work well unless you have hardware support.
In other words, while it’s certainly pretty cool that VLC is set to become one of the first Swiss Army Knife video players that can run on Windows, Mac, Linux, and Android, I’d be surprised if it works much better than RockPlayer, MoboPlayer, or any of the other video players currently available for Android.

To download VLC for Android Click Here

-News Source (Video LAN & Mobiputing)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">VLC Media Player (Beta) for Android is Now Available"https://www.voiceofgreyhat.com/2011/09/vlc-media-player-beta-for-android-is.html</a>

Tenable Network Security Released Nessus Android Application

“Network security isn’t a 9-5 job,” said Ron Gula, CEO of Tenable Network Security. “The ability to conduct vulnerability scans and review results anytime from anywhere is exactly what enterprise IT and security professionals expect from their software and service providers, and it’s what they need to keep their networks safe, 24/7.” Tenable is the first company to release an Android-based mobile application for vulnerability scanning. The Nessus Android application is available at no cost at the Android Marketplace and is located under the productivity category. It allows users to take advantage of the advanced capabilities of the Android user interface.Features of the Nessus Android application include remote starting, stopping and pausing of network scans as well as the ability to analyze scan results. Mobile access speeds the Incident Response process – allowing a security professional who is responding to an incident to quickly log into a Nessus scanner during a meeting to find a host with a given vulnerability.Tenable Network Security, Inc.the leader in Unified Security Monitoring (USM) and creator of the widely-used, award-winning  enterpriseSecurityCenter and Nessus® vulnerability scanner, today announced that it has released an Android application for its Nessus Vulnerability Scanner, enabling Nessus users to remotely connect to a Nessus server, launch scans and review reports from their Android devices.

Click Here To Download Nessus

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Tenable Network Security Released Nessus Android Application"https://www.voiceofgreyhat.com/2011/06/tenable-network-security-released.html</a>

Google Patches Sidejacking Vulnerability

Google has been rolling out a server-side patch for the ClientLogin authentication protocol vulnerability that affects 99.7% of Android smartphones.
"We recently started rolling out a fix which addresses a potential security flaw that could, under certain circumstances, allow a third party access to data available in calendar and contacts. This fix requires no action from users and will roll out globally over the next few days," said a Google spokesperson via email.

 Google's fix comes in response to a warning, published earlier this month by researchers at the University of Ulm in Germany, that Android devices could be exploited in a sidejacking-like attack. Just as website session cookies can be stolen (sidejacked), allowing attackers to impersonate a user, attackers could sniff data being sent to and from Android smartphones that are connected to unsecured Wi-Fi networks--by using a tool such as Wireshark--and capture tokens for any Google service that uses the ClientLogin authentication protocol. Applications that use this protocol include Google Calendar, Contacts, and Picasa, as well as third-party applications for Facebook and Twitter.
Android smartphone users running the latest OS, 2.3.4, were already protected against the vulnerability. But 99.7% of Android users are still on older operating systems.
Accordingly, Google's solution has been a server-side fix that forces Android devices to use HTTPS--to keep data encrypted--when syncing with the Google Contacts or Calendar, so that authentication credentials can't be intercepted. "The great news is that it doesn't require a software update on the Android devices themselves--meaning the fix is automatic and worldwide. Effectively this is a silent fix," said Graham Cluley, senior technology consultant at Sophos, in a blog post.
No attacks have been seen that exploit the vulnerability, and a fix is still in the works for Picasa. For now, Picasa users can mitigate the vulnerability by avoiding unsecured Wi-Fi networks, which would prevent their authentication credentials from being stolen.
Security-wise, Google's server-side patch is a crucial move because most cell phone carriers rarely push patches or OS updates to their customers. Because of that, some industry watchers had worried that Google would have difficulty securing older devices. For now, it's dodged that bullet, but in the future, major flaws could still pose a problem. "Concerns still remain as to how easy it would be to fix a serious security vulnerability on the Android devices themselves, given that Google is so reliant on manufacturers and carriers to push out OS updates," said Cluley.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Google Patches Sidejacking Vulnerability"https://www.voiceofgreyhat.com/2011/05/google-patches-sidejacking.html</a>

Android Malware 'Loozfon' Targeting Female Android Users -Said Symantec

Android Malware 'Loozfon' Targeting Female Android Users -Said Symantec

We are very much familiar to see Malware has targeted men by enticing them to view videos or pictures of a sexually-oriented nature. But here the story is totally different, recently Antivirus firm Symantec has discovered discovered 'Android.Loozfon' a rare example of malware that targets female Android users.

According to the symantec official blog -A group of scammers is attempting to lure female Android users in Japan into downloading an app by sending emails stating how the recipient can easily make some money. The email includes a link to a site that appears to be designed to assist women to make money simply by sending emails. When a certain link on the site is clicked, Android.Loozfon is downloaded onto the device. Other links direct the user to a dating service site that likely attempts to charge money to use the service, which supposedly helps women meet rich men.

If this trick does not work, the criminal group has another trick up its sleeve. It also sends spam that states that the sender of the email can introduce the recipient to wealthy men. When the link included in the body of the email is clicked, the malware is automatically downloaded onto the device. The downloaded app is titled “Will you win?” in Japanese. It has nothing to do with earning extra income or wealthy men.

If the app is installed and launched, it counts down from two to zero and then states that the user has lost. The app is programmed to lose every time, although there is nothing to either lose or win. It steals contact details stored on the device as well as the phone number of the device, which is the main goal of the malware. The scammers are likely harvesting email addresses in order to send spam to the contacts they were able to steal to lure them to the dating service site and/or sell the data to another group of spammers.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Android Malware 'Loozfon' Targeting Female Android Users -Said Symantec"https://www.voiceofgreyhat.com/2012/08/Android-Malware-Loozfon-Targeting-Female-Android-Users.html</a>

ESET Released Antivirus for Android in Beta

ESET is well-known in the PC arena for its NOD32 antivirus and ESET Smart Security suite. The company's existing mobile security product supports Windows Mobile and Symbian devices. ESET Mobile Security for Android Beta (free, direct) extends the same protection to the Android realm.

ESET Mobile naturally includes protection against Android malware. It checks processes and new apps in real time and also scans for threats on demand. Some mobile security products eliminate almost all antivirus configuration settings. Lookout Mobile Security is an example. ESET includes a full set of configuration choices, much like what you'd find in a PC-based antivirus. It uses heuristic analysis, it can quarantine suspect files, and it optionally scans inside archives, among other things.

Like Kaspersky Mobile Security 9, Norton Mobile Security 2.0 Beta, and others ESET Mobile can respond to coded SMS messages by locking the phone, transmitting its GPS location, or wiping all data from the phone. You can't track the phone by logging in to a Web site the way you can with GadgetTrak Mobile Security for Android & Blackberry 3.1, Mobile Superhero, and others, but ESET's SMS response to a location request includes a Google Maps link.

A thief who attempts to evade ESET's protection by swapping out the SIM card won't get far. Insertion of a SIM card not already marked as trusted will cause the phone to automatically lock and secretly send an alert SMS to one or more predefined contacts. The alert SMS contains the new SIM card's phone number, the IMSI (International Mobile Subscriber Identity) number and the phone's IMEI (International Mobile Equipment Identity) number. ESET also protects against uninstallation on Android 2.2 and later.

ESET's antispam feature isn't as ambitious as that of PrivacyStar and Mr. Mr. Number, which use crowdsourcing to block known spam callers. You can set ESET to block specific blacklisted numbers or to block all incoming calls and texts that don't come from your contacts. The app retains information about blocked contact attempts, so you can review the contact log and make any necessary adjustments.

The most unusual feature ESET offers is the security audit. This isn't an audit of app permissions like that found in Lookout and in Webroot Mobile Security for Android. ESET audits the device daily and automatically fixes everything it can. You can also manually run an audit at any time. ESET alerts if battery power or free disk space are too low. It reports security problems with Bluetooth, GPS, and GSM Network as well as with installed applications and stored data. The included Task Manager lets you view running processes and terminate non-system processes.

This app, currently in beta testing, can be downloaded from the Android Market or directly from the ESET Web site.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">ESET Released Antivirus for Android in Beta"https://www.voiceofgreyhat.com/2011/06/eset-released-antivirus-for-android-in.html</a>

Google I/O Kicks Off Tuesday: All Eyes On Android And New-Look Exec Team

Every major tech company in Silicon Valley takes at least one turn at San Francisco’s Moscone Center each year to show off their latest ideas and reinforce their standing among the community. This week, Google (NSDQ: GOOG) gets a shot, likely to highlight versions of its Android software for phones, tablets, and televisions while continuing to push a vision of computing with the Web at its center.

Google I/O has grown significantly since 2008, with the fourth incarnation set to kick off Tuesday. Nearly 5,500 attendees are expected to pony up for access to Google’s roster of engineers, who will present sessions on nearly everything Google, from search to Web application development to browsers to mobile applications. Here’s a breakdown of what to expect:

Android: Google’s most successful product outside of search, Android, will likely draw the most attention during the week. The smartphone version of Android has been a rousing success, but tablet versions have yet to create any serious alternative to Apple’s iPad. It would be surprising if Google didn’t address the tablet question in some detail, either through new operating system versions or applications.

Google TV: One version of Android that hasn’t really taken flight—Google TV—has been reported as worthy of an Google I/O slot. First introduced a year ago at this conference and launched last November, Google TV has faced opposition from the big network television companies and confusion among customers who encounter its remote controls. A preview of a next-generation version is expected, but enthusiasm for the concept in general is not strong leading into the show.

Chrome OS: Netbooks bearing Google’s browser-centric operating system were supposed to have been launched last year, but delays forced the project into a mid-2011 launch schedule. Now that it’s May 2011, presumably Google is ready to shed more light on exactly what types of Chrome OS netbooks will launch, and how much they will cost. It will also be interesting to see if Google talks up Chrome OS tablet-style devices, given that interest in the netbook has waned considerably since Chrome OS was first announced in 2009.

Web Standards: Google has used significant air time at the previous Google I/O conferences to urge adoption of HTML5 technologies as the pathway to a next-generation model of computing centered on the Web. This is still very much a work in progress. Expect Google to continue the evangelical call this week, with demonstrations of the types of sophisticated Web applications that are possible with HTML5 technologies.

Wild Cards: Some form of a Google music locker is inevitable, but has the company locked down enough of the details with the music industry for it to surface this week? Will Google Docs finally get offline access? Which Android tablet will Google give away to attendees, the Xoom or the Galaxy Tab?

Context: Google is a company that famously likes to celebrate its failures. That means Google I/O is probably its most celebratory week of each year, considering it has produced such notable failures as Google Wave and Google Friend Connect. As pointed out over the course of the weekend, Google doesn’t necessarily save some of its most winning ideas for Google I/O: Google Instant was announced at its own event last September, for example.

However, this is the first Google I/O with Larry Page back at the helm of the company, and therefore the first chance for him to really put his stamp on the show. Google has been furiously reorganizing its executive ranks in the weeks since Page has taken over, and this Google I/O may give hints as to the new pecking order at Google with respect to the types of projects demonstrated at the show, and the people chosen to pitch those projects to the world.

It’s a week in which all eyes will be on the company that dominates Web search, fumbles with social skills, and provides a defensible alternative to Apple (NSDQ: AAPL) in the mobile market. We’ll be at Google I/O both days, and will bring you highlights and analysis of Google’s week in the spotlight.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Google I/O Kicks Off Tuesday: All Eyes On Android And New-Look Exec Team"https://www.voiceofgreyhat.com/2011/05/google-io-kicks-off-tuesday-all-eyes-on.html</a>

Wikipedia Released Their Official Application For Android

Today Wikipedia announced the availability of their official Wikipedia Application for Google's open source Android mobile operating system also known as Android 4.0, Ice Cream Sandwich (ICS). With the new app for the online encyclopedia users can search the entire Wikipedia site as well as find articles for nearby points of interest. Articles can be saved to a user's device for offline viewing or shared using the Android "Share" function, allowing users to send an article via, for example, email or text message. Previously Wikipedia released their official application "Wikipedia Mobile" for iTunes App Store, iOS devices like the iPhone. 

The official Wikipedia app for Android is available to download from the Android Market and requires Android 2.2 "Froyo" or later.  

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Wikipedia Released Their Official Application For Android"https://www.voiceofgreyhat.com/2012/01/wikipedia-released-their-official.html</a>

Ice Cream Sandwich (Android 4.0) Source Code Released

Google officially released the source code of long waited Android 4.0 also known as Ice Cream Sandwich (ICS). Although the repositories will also contain the source code of Android 3.x, Honeycomb, it will be scattered through the history of the various files. Honeycomb was not released as open source because, according to Google, the company took numerous shortcuts in the development of the tablet version of Android. The Google developers are not globally tagging (marking in the history) the 3.x releases of Android in the repository. Queru said: "since Honeycomb was a little incomplete, we want everyone to focus on Ice Cream Sandwich", though he later backed off on this position slightly saying he was considering tagging some of the 3.2.x release in the frameworks to help developers. 

The release comes with ICS 4.0.1, the one Galaxy Nexus will ship with, so it’s the latest version. Unfortunately the device build target, full_maguro, can be used for building a system image for the Samsung Galaxy Nexus, though we will get builds for more devices soon, according to Queru. Hopefully developers will be able to port it to other devices pretty soon, because I would really like to see how ICS runs on my Galaxy S II.
There were many rumors that Google will release the Galaxy Nexus at the November 16th event and once with this release we can be nearly sure that’s what the event will be about. All we have to see next is if Google will have more luck with their new device in comparison with the other Nexus-branded smartphones. They will probably be able to take advantage of the fact it will be only ICS smartphone, though I am pretty sure Samsung, HTC, Motorola and all the others will do their best and move fast to release ICS smartphones and updates for the ones currently on the market. Ice Cream Sandwich is the latest and probably the biggest Android update, which unites all devices into one OS and promises a lot of improvements, like speed and battery life. It also comes with exciting new features and an all-new design. It will probably boost Android’s sales even more.

To download the ICS Source Code Click Here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Ice Cream Sandwich (Android 4.0) Source Code Released"https://www.voiceofgreyhat.com/2011/11/ice-cream-sandwich-android-40-source.html</a>

Think Android: National Security Agency Disclosed Smartphone Strategy

Think Android: National Security Agency (NSA) Disclosed Smartphone Strategy

The National Security Agency has come up with a security design that currently depends on Google Android smartphones, though the NSA contends it doesn't want to be wedded to any particular smartphone operating system. But its current "Fishbowl" phones, as they are called, are beefed-up highly secured Motorola Android smartphones that use double-encryption for voice traffic and a unique routing scheme for 3G network traffic back to the NSA first for security purposes. This design makes them suitable for classified information sharing with other like smartphones, according to Margaret Salter, technical director at NSA's information assurance directorate, who spoke about the so-called "Fishbowl" project, which today focuses on voice use of smart phones.

"We wanted to use the commercial standards that are out there," said Margaret Salter, technical director in NSA's information assurance directorate. "We wanted plug and play — but that was hard." The NSA also wants interoperability in order not to be trapped in vendor ok-in, but this is turning out to be hard to achieve. Earlier in January 2012 NSA has released the first public release of the Security Enhanced (SE) Android Project, a program designed to find and plug security holes and risks in the Android flavor of Linux. SE Android is based on the NSA’s SELinux, first released in 2000.
The NSA looked at SSL VPN as a standard and left no stone unturned in exploring commercial SSL VPN for mobile, but found utter lack of interoperability across vendor products. Salter said NSA also was frustrated with the lack of interoperability in Unified Communications Systems (UCS) products, noting that buying one piece often meant buying several others, there being little evidence of multi-vendor interoperability. So with some frustration, NSA changed to go with an open-source Session Initiation Protocol (SIP) server for the present. NSA also switched its mobile security strategy toward IPSec VPN, where things looked better in terms of interoperability than SSL VPN, and selected the Secure Real-Time Transport Protocol for Voice App and Transport Layer Security (TLS) with keys. This all means "the voice call is doubly encrypted," Salter said. "There's VoIP encryption and IPsec encryption."

-Source (IT World)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Think Android: National Security Agency Disclosed Smartphone Strategy"https://www.voiceofgreyhat.com/2012/03/think-android-national-security-agency.html</a>

Google Is Planning To Bring Android Operating System Onto The Desktop

Google Is Planning To Bring Android Operating System Onto The Desktop

Earlier in this week we have covered that Canonical has announced a new product called Ubuntu for Android that will bring the popular Linux distribution to high-end Android smart phones. Now in a move that's essentially a mirror image of Canonical's announcement, it appears Google is planning to bring its Android mobile operating system onto the desktop. “Android is headed for the desktop and today's report lays out Google's specific work on trackpad operations corresponding to touchscreen events,” wrote Patently Apple's Jack Purcher in a Wednesday special report.  Google and Intel are already collaborating on a project to adaptAndroid for x86 architectures and several other related efforts. Also, it has been observed that both the mobile and desktop computing worlds are gradually converging. Owing to this, operating systems are rapidly taking a multiscreen approach. One such instance has already been seen with Windows 8 and its Metro interface. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Google Is Planning To Bring Android Operating System Onto The Desktop"https://www.voiceofgreyhat.com/2012/02/google-is-planning-to-bring-android.html</a>

NASA Certified First Commercial Smartphone (Android-based Nexus S)

Just when you thought Google was losing its appeal with its Google Plus network, here comes another biggie that might add a feather to the company’s colourful hat.
NASA revealed that they prefer working with Android on their Space Stations and that Nexus S is being used by NASA to run its SPHERE satellites. SPHERE satellites are free-floating devices that were in fact inspired by Star Wars, according to NASA. They have been placed on the International Space Station right from 2006, which dates back to pre-Android days. Android is being used on a special expansion port which would allow NASA to utilize the highly customizable Android OS to add additional sensors and features. Nexus S devices are being touted by NASA as the first commercial Smartphones to be certified to fly on the space shuttle.
Nexus S’ CPU would be used to power SPHERE’s ‘brains’ and the robots would be able to monitor and sense more external data that can be controlled and observed remotely from Earth, thanks to its Wi-Fi connection. NASA made no attempts to hide their happiness with Google and Android OS, which definitely gives Google the boost that it required in the last few weeks. Most people have begun to complain that Google Plus pages are almost empty without any updates, though it is filled with people.
Such criticisms may no more affect the bigwigs at Google, who would now be patting their own backs after NASA declared Android OS to be their preferred mobile operating system. One shouldn’t be surprised if Google makes an attempt to try and do something with space research as well. This news would surely have ruffled feathers of Apple and other competitors who have been fighting Google’s juggernaut that has been throwing its weight around in Internet, mobile and even home device technologies.

-News Source (NASA & Walyou)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">NASA Certified First Commercial Smartphone (Android-based Nexus S)"https://www.voiceofgreyhat.com/2011/09/nasa-certified-first-commercial.html</a>

BlueStacks App (Play Android Application on Windows PC)

Android applications are now playable on your Windows PC. Bluestacks has released an alpha-test version of software which allows Android apps to be run on Windows machines. The start-up spoke with El Reg earlier this year about its eponymous product and how it works. Well, now you can try it for yourselves.
The 117MB file creates a little widget on the desktop. When launched, it offers a list of available apps. As it stands there is no Android Market support, although Bluestacks has its own Apps Channel with a small selection of utilities and games.
The company has also released an app called Cloud Connect. It can be downloaded from the Android Market and lets users send apps from their handsets to a PC, thus opening doors for any Android software to run on the Windows platform.

Video Demonstration of BlueStacks App Player for Windows PC:-

To download BlueStacks App Player (alpha) click Here

-News Source (BlueStacks)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">BlueStacks App (Play Android Application on Windows PC)"https://www.voiceofgreyhat.com/2011/10/bluestacks-app-play-android-application.html</a>

Zero-Day Vulnerability In Flash Patched By Adobe

Zero-Day Vulnerability In Flash Patched By Adobe 

Yet another Zero day vulnerability found in Adobe Flash Player. Earlier hackers found zero-day exploit in flash player which can allow an attacker to hack you web-cam remotely later Adobe patched that. Before releasing Flash Player 11 Adobe issued new privacy policy and security update but now it seems that those are of zero use. 11.1.102.55 and earlier versions for Windows, Macintosh, Linux and Solaris, Adobe Flash Player 11.1.112.61 and earlier versions for Android 4.x, and Adobe Flash Player 11.1.111.5 and earlier versions for Android 3.x and 2.x. These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

Affected Version:- 

• Adobe Flash Player 11.1.102.55 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems

• Adobe Flash Player 11.1.112.61 and earlier versions for Android 4.x, and Adobe Flash Player 11.1.111.5 and earlier versions for Android 3.x and 2.x

Later Adobe confirmed that and immediately released a patch to close the security hole. Through this security release Adobe also resolves a universal cross-site scripting vulnerability that could be used to take actions on a user's behalf on any website or webmail provider, if the user visits a malicious website. There are reports that this vulnerability (CVE-2012-0767) is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message (Internet Explorer on Windows only). Google's Chrome Web browser, which directly integrates Flash into its software (unlike competing browsers) also received an update to reflect Adobe's patch update. 

Recommendation From Adobe:-

Adobe recommends users of Adobe Flash Player 11.1.102.55 and earlier versions for Windows, Macintosh, Linux and Solaris update to Adobe Flash Player 11.1.102.62. Users of Adobe Flash Player 11.1.112.61 and earlier versions on Android 4.x devices should update to Adobe Flash Player 11.1.115.6. Users of Adobe Flash Player 11.1.111.5 and earlier versions for Android 3.x and earlier versions should update to Flash Player 11.1.111.6. For further details click here.

Earlier in 2011 another Flash Player bug found in Blackberry OS & later fixed by the developer and also last year adobe closes serious security hole in Acrobat 9X & Adobe Reader.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Zero-Day Vulnerability In Flash Patched By Adobe"https://www.voiceofgreyhat.com/2012/02/zero-day-vulnerability-in-flash-patched.html</a>

Adobe releases Flash Player 10.3 update for Windows, Mac, Linux and Android

Adobe has released the latest update for Flash Player, version 10.3. The update works with all Flash-enabled platforms, including Windows, Mac OS, Linux and Android, with support for the most recent 3.1 update to Honeycomb. You can nab the download on the web at Adobe.com or through Android Market on your mobile device

The latest Flash update is all about squashing bugs and making things work more smoothly. On the Android side, that means NEON optimizations for OMAP4-based devices (pretty much just the BlackBerry PlayBook for now), various fixes for the Samsung Galaxy S, HTC EVO and some Motorola devices and some optimizations for Android 3.0+. All of the fixes are detailed on Adobe’s Android patch notes page. There are a variety of fixes on the non-mobile side as well, along with a handful of new features.
In addition to some new developer tools for measuring video and acoustic echo cancellation, there are also now new controls for managing local storage that have been integrated directly into your browser’s privacy settings, with support for Mozilla Firefox 4, Microsoft Internet Explorer 8 and higher, Google Chrome 11 and “a future release of Apple Safari.” The update also adds a dedicated Flash Player Settings Manager to Control Panels/System Preferences on Windows, Mac and Linux computers, and auto-updated notifications for Mac OS. 
Download Adobe Flash Player 10.3

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Adobe releases Flash Player 10.3 update for Windows, Mac, Linux and Android"https://www.voiceofgreyhat.com/2011/05/adobe-releases-flash-player-103-update.html</a>

Android & NVIDIA Forum Hacked, Millions of User Credentials Stolen

Android & NVIDIA Forum Hacked, Millions of User Credentials Stolen 

After the massacre of Formspring & Yahoo! Voice yet again security breach effected NVIDIA & Phandroid Forum. Hackers have gained illegal access and stolen millions username & password hashes from those said forums.

NVIDIA has temporarily shutdown its online developer forum, after it fell victim to cyber criminals who may have gained access to members' hashed passwords. NVIDIA says that it took the site down last week to investigate intrusions into its systems by unauthorised third parties. The intruders reportedly gained access to private user data, including usernames, email addresses, and hashed passwords with random salt values. Data in users' "About Me" profiles, such as age, birthdate, gender and location, was also accessed in the breach; however, this information was already publicly accessible on the site.

In the security notice, NVIDIA said that it is currently "employing additional security measures to minimize the impact of future attacks", adding that it hopes to restore the Forums as soon as possible. Once restored, the company says that it will reset all user passwords and send an email to users with a temporary password and instructions on how to change it

Phandroid, a popular Android news site & online community popular with fans of Android smartphones faced cyber attack. Phandroid has confirmed that its Android Forums was compromised using "a known exploit", and data including usernames, hashed passwords and so forth were accessed. According to Phandroid's notice about the security breach, the user table of Android Forum's database was accessed by unknown intruders. 

The database in question contains a variety of information on forum users, including usernames, email addresses, hashed and salted passwords, registration IP addresses; also other forum-related data, such as last time online and post date as well as post count. Based on current information, the site's community manager says that they cannot confirm if the data was in fact downloaded, adding that they believe the attack was "most likely an e-mail harvesting attempt". Additional steps to further harden server security and "extra 'just in case' actions" have also reportedly been taken.

As per report more than 1 million users of Phandroid forum are potentially affected by the security breach. The site's administrators advise all users to change their passwords as soon as possible through the User Control Panel (UserCP) or by using the "Forgot your password?" function.

We would like to give you reminder that other sites who have been hit by hackers, while stealing information about users in recent weeks include Yahoo Voices, Formspring, eHarmony and LinkedIn. There also we have seen the same scenario where hackers have stolen millions of user credentials of those sites. 

 -Source (NVIDIA, Phandroid, The-H)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Android & NVIDIA Forum Hacked, Millions of User Credentials Stolen"https://www.voiceofgreyhat.com/2012/07/android-nvidia-forum-hacked-millions-of.html</a>

Facebook Application For iOS & Android Have Security-Hole Which Allows Identity Theft

Facebook Application For iOS & Android Have Security Hole Which Allows Identity Theft 

Facebook users again under risk.  Recently a new security vulnerability found in Facbook application for iOS & Facebook application for Android. Researcher app developer Gareth Wright, who discovered the issue, said it comes down to Facebook’s native apps for the two platforms not encrypting your login credentials, meaning they can be easily swiped over a USB connection, or more likely, via malicious apps. Facebook has responded that this issue only applies to compromised or jailbroken devices. Means if you are using a jailbroken iOS device or a rooted Android device then your identity can easily be theft. Wright copied the hash and tested a few FQL queries. "Sure enough, I could pull back pretty much any information from my Facebook account. As of the 1st of May 2012 these tokens run out after 60 days but aside from that a simple .Net tool could easily snaffle this info and grab a fair whack of confirmed email addresses and marketing info.
“Not good, but then I had to wonder what the Facebook app stored. Popping into the Facebook application directory I quickly discovered a whole bunch of cached images and the com.Facebook.plist. “What was contained within was shocking. Not an access token but full oAuth key and secret in plain text. Surely though, these are encrypted or salted with the device ID. Worryingly, the expiry in the plist is set to 1 Jan 4001!" 

“Facebook’s iOS and Android applications are only intended for use with the manufacture provided operating system, and access tokens are only vulnerable if they have modified their mobile OS (i.e. jailbroken iOS or modded Android) or have granted a malicious actor access to the physical device,” a Facebook spokesperson said in a statement. “We develop and test our application on an unmodified version of mobile operating systems and rely on the native protections as a foundation for development, deployment and security, all of which is compromised on a jailbroken device. As Apple states, ‘unauthorized modification of iOS could allow hackers to steal personal information … or introduce malware or viruses.’ To protect themselves we recommend all users abstain from modifying their mobile OS to prevent any application instability or security issues.”
As for the USB connection scenario, Facebook says there’s no way to fix this problem. Note that in this case it doesn’t matter if your device is jailbroken or not, because whoever is doing the deed has physical access to your phone or tablet.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Facebook Application For iOS & Android Have Security-Hole Which Allows Identity Theft"https://www.voiceofgreyhat.com/2012/04/facebook-application-for-ios-android.html</a>

Malicious Android Application Stealing User Data & Personal Information

Malicious Android Application Stealing User Data & Personal Information 

Yet again security vulnerability found in Android application. An information security company has warned about malicious Android smartphone applications that steal and transmit personal data, such as contact information stored in users' address books. The company said these types of free applications have been downloaded up to 270,000 times, indicating that potentially millions of people have had their personal information stolen. An Internet security expert said, "It's possible that creating applications that transmits users' information without consent can be considered a crime under the Penal Code, which criminalises the creation of computer viruses." The malicious application only has three buttons: Steal SD Card Contents, Steal App Data, and Upload Identifying Data.Every application has at least read-only access to the contents of this external storage. No Permissions scans the /sdcard directory and returns a list of all non-hidden files. All the files discovered can be fetched. The worrying part is that the SD card usually stores some of our most private files, including photos, backups, external configuration files, and, in some cases, even Open VPN certificates.

According to NetAgent, a Tokyo-based information security company, the applications were disguised as video tutorials for popular games on Google Inc.'s Android operating system. The applications were named by affixing the expression "the Movie" to existing game titles. The company found at least 16 of these applications.
The company's analysis revealed that when these applications are activated, they can automatically transmit not only a person's telephone number, their e-mail address and the phone's ID number, but also the personal names, telephone numbers and e-mail addresses of contacts stored on the smartphone's address book. Although the creators of these applications aren't well known, the stolen information was sent to the same domestic server. When users download the malicious applications, a message pops up on the display screen requesting permission for access to contact information. What ever the malicious application was immediately deleted from Android market. For additional information click here.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Malicious Android Application Stealing User Data & Personal Information"https://www.voiceofgreyhat.com/2012/04/malicious-android-application-stealing.html</a>

Next Generation Mobile Security Solution For Android By Trend Micro Mobile Security

Trend Micro, Inc. (tyo:4704) a global cloud security leader and long-time innovator in mobile security, today announced the latest addition to Trend Micro's Mobile arsenal, Trend Micro(TM) Mobile Security Personal Edition, a solution designed to protect both Android smartphones and tablets that includes a free app scanner, lost device protection and enhanced security to block threats while surfing the Web, calling or texting.
In January 2011, Trend Micro introduced Trend Micro(TM) Mobile Security for Android(TM) during CES in Las Vegas, NV. Early features included:

• Safe surfing

• Parental controls

• Download protection

• Call and text filtering

As Android devices gain in popularity so does its use from cybercriminals. Trend Micro's threat researchers have tracked new threats targeting Android devices growing at 800% since February 2011. In this version, which also follows the release of Trend Micro's Enterprise solution, Trend Micro Mobile Security 7, a consumer's mobile devices will be better protected based on the new data that has been discovered over the last six months. New and enhanced features include:
New App Scanner: Designed to block infected apps from installing and stealing your personal information
New Lost Device Protection: From a personal online portal, you can locate a lost device, trigger an alarm, remotely lock it or even wipe it clean to protect your personal information.
Enhanced Surf, Call, and Text Security: Designed to block online threats like banking scams, blocks unwanted calls and text messages and designed to block inappropriate websites to protect your children. "We believe mobile users need to be protected against malicious applications. To help protect as many people as possible and stifle criminal attempts to steal personal and financial information we are offering our anti-malware scanner for free." said Carol Carpenter, General Manager, Consumer Business at Trend Micro.
Additional enhancements offer a secure Web-based portal that enables users to remotely find a lost device on a Google map and set off an alarm, even if the device is set to silent. If the device can't be found it can be locked from the portal and if all else fails the user can wipe the contents by triggering a factory reset. As a safeguard, if the SIM card is removed the device is also automatically locked. The Web-based portal provides an easy user experience for those who may be in a state of panic over the whereabouts of their device. They just need to remember http://www.TrendMicro.com/ilostmyandroid .
With the sheer amount of personal information now being stored and transacted via these devices it is imperative that misplaced devices be recoverable or the sensitive information deleted. Not only do these devices allow a 3rd party to run up phone and data bills, but they could potentially grant access to online banking, social networking and in some cases even provide access to home automation systems including doors and alarms.
"With over 200,000 devices currently protected with prior or Beta versions of the solution, and Trend Micro's history of protecting mobile platforms since the middle of last decade. We are confident in our ability to provide a range of solutions that enable people to live out their digital lives in a safe and secure fashion." concluded Ms Carpenter.
Trend Micro Mobile Security Personal Edition also gives users the ability to protect their web surfing, calls and texts. Leveraging the power of the Trend Micro(TM) Smart Protection Network infrastructure, which blocks over 5 billion threats daily, all websites visited on the device browser are checked against the same reputation databases that protect Trend Micro's global customer base. Parents can set web surfing policies to block inappropriate content. And calls and text message scan be blocked to avoid time wasting, costly and unwanted contact. Trend Micro Mobile Security Personal Edition is available via the Android Market and major retail stores. While the app scanner is free, the premium services, including Lost Device Protection and Surf, Call, Text Security are available for USD$29.99 for a 1 year license.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Next Generation Mobile Security Solution For Android By Trend Micro Mobile Security"https://www.voiceofgreyhat.com/2011/09/next-generation-mobile-security.html</a>