Malicious ad can steal users’ local files on Firefox

Heads up, Firefox users — Mozilla is urging you to update your browser post-haste, after a rogue advertisement on a Russian news site was found to be exploiting a vulnerability that compromised Firefox users’ local files.
 
“The vulnerability comes from the interaction of the mechanism that enforces JavaScript context separation (the “same origin policy”) and Firefox’s PDF Viewer,” explained Mozilla’s security head, Daniel Veditz, in a blog post.
 
In effect, the attacker was able to circumvent Firefox’s security and inject a malicious script that searched for key files on a user’s machine and then uploaded them to a remote server, thought to be located in the Ukraine. This would’ve applied to anyone loading the page with the exploit on it — and the exploit left no trace, according to Mozilla.
 
The issue was reported on Wednesday, August 5, with a security update issued yesterday. While Mozilla says only Windows and Linux users were apparently targeted, the malware could easily be adapted for Mac users too — so everyone is encouraged to update to the latest version.
 
Even if you haven’t visited the Russian news site in question, it’s not known whether the ad has been deployed elsewhere. Firefox for Android, and other Mozilla products that don’t sport the built-in PDF Viewer, are not affected.
 
While ad-blocking is still frowned upon by many, this latest incident could provide people with added justification for using ad-blocking software on their computers.
 
News Source: VentureBeat

Read More

Nexus devices will now receive monthly over-the-air security updates according to Google announcement

The first Nexus security update is rolling out from last day (August 5th, 2015) for Nexus 4, Nexus 5, Nexus 6, Nexus 7, Nexus 9, Nexus 10, and Nexus Player. Google says it contains fixes for issues in bulletins provided to partners through July 2015, including fixes for the aforementioned Stage fright vulnerability. Google also promises to release the same security patches to the public via the Android Open Source Project

Google’s support for Nexus devices remains unchanged: Devices will continue to receive major updates for at least two years. That said, the company is promising Nexus devices will get security patches “for the longer of three years from initial availability or 18 months from last sale of the device via the Google Store.”

Google’s move today is a big deal. Security updates need to be delivered immediately, and definitely should not be blocked or delayed by carriers. A monthly update isn’t exactly timely, but it’s a huge improvement from the previous system, where users simply didn’t know when their device would be patched.



Source: venture beat

Read More

Hackers can remotely steal fingerprints from Android phones

Your fingerprints might not be as safe as you think they are on your Finger Print Sensor enabled Android Devices.

The threat is for now confined mostly to Android devices that have fingerprint sensors, such as Samsung, Huawei, and HTC devices. Hackers prove that HTC One Max and Samsung's Galaxy S5, allows a hacker to stealthily acquire a fingerprint image from an affected device because device makers don't fully lock down the sensor. Worst is, the sensor on some devices is only guarded by the "system" privilege instead of root, making it easier to target. Once the attack successful, the fingerprint sensor can continue to quietly collect fingerprint data on anyone who uses the sensor.
Affected vendors have since provided patches after being alerted by the researcher hackers. The researchers did not comment on which vendor is more secure than others. But Apple's iPhone, which pioneered the modern fingerprint sensor, is "quite secure," as it encrypts fingerprint data from the scanner, they said.

The only way to stay secured, as per the researchers said, is to keep updated to every major updates and installing apps from secure and trusted sources only.

Read More

Nest Cam, The $199 security camera is your all in one video surveillance solution

The Nest Cam is basically a successor of Dropcam Pro, but with a thinner, sleeker and robust design, better imaging, even easier setup, and a built-in microphone so you can send your voice to your home remotely.

The Nest Cam costs $199 and works with your smartphone (iOS and Android), tablet or computer. Nest Cam saves 10 days video footage and costs you $100 a year for the Cloud storage. Well, it might sound a little costly, but but consider the peace of mind you'll get if you're using the Nest Cam to monitor your baby or kids at home.

 

 

News & Video from Mashable

Read More