Major Security Flaw Found in Silent Circle's Blackphone

Security researchers at SentinelOne on Wednesday revealed a vulnerability they discovered in the Blackphone.

The flaw -- an obscure socket -- lets an attacker take over and control communications on the Blackphone, a highly secure Android smartphoneSilent Circle developed and marketed in reaction to news of government surveillance of people's communications.

Silent Circle began taking preorders for the device in 2014, and "despite [its] best attempts, a severe zero day remained undetected for nearly a year before we uncovered it," said Tim Strazzere, SentinelOne's director of mobile research.

No Evidence of Exploitation

The vulnerability, a socket left open and accessible on the Nvidia Icera modem used in the Blackphone, lets attackers take control of many of the modem's functions, including sending and receiving text messages, dialing or connecting calls, and changing the phone's settings.

Attackers could use a malicious application that exploits the vulnerability in the background without the device owner's knowledge, Strazzere told TechNewsWorld.

Exploit-based attacks would be used against this open socket, and "any antivirus- or antimalware-based technology wouldn't prevent it," he observed. "Even an HIPS-based solution that focused on exploits would have missed it since this is a zero-day-based vulnerability with no available signatures used for protection."

The options available to an attacker "are extensive," Strazzere remarked, but "we have seen no evidence that [it] was ever used for surveillance or malicious purposes."

The vulnerability was discovered during a reverse engineering exercise to prepare for a Red Naga training session. Red Naga is a security training group Strazzere and friends created to teach, train and grow the mobile security community at no cost.

The Icera modem is fairly obscure, used only by the Nvidia Shield tablet and "a few phones in India," Strazzere noted.

Because it's obscure, few security researches have looked into it, and devices in the field "might not be getting updates or the attention that more popular modems would receive," he said.

Following notification from SentinelOne, Silent Circle patched the vulnerability, which was found on the Blackphone 1.

It's not clear whether it exists in the Blackphone 2, which Silent Circle released in September.

The Third-Party Risk Factor

It's possible the socket was left open for debugging purposes in preproduction and was mistakenly left that way in production devices, Strazzere speculated.

Most mobile makers use third-party technology.

Third parties for both hardware and software components "are part of the supply chain for mobile device manufacturers and represent a significant risk," said Tim Erlin, director of IT security and risk strategy for Tripwire.

However, providing assurance for both hardware and software "has really been limited to high-level government equipment, so there are few assurance operations [for] the consumer goods market," he told TechNewsWorld.

Third-party providers typically are granted access to critical elements of the internal infrastructure and to sensitive data, said István Szabó, product manager at BalaBit. One remedy would be to monitor and record all activities when third parties access internal systems.

Such monitoring "gives the mobile device producer the ability to detect and immediately terminate sessions if something suspicious occurs ... and provides important evidence to help investigations should an incident occur," he told TechNewsWorld.

Another option is to use a behavioral-based technology such as the one SentinelOne offers to detect, prevent and remediate against attacks.

Silent Circle did not respond to our request to comment for this story.


Source by: http://www.technewsworld.com

iPhone Sales Could Be Slowing

In the runup to the release of Apple's Q1 2016 earnings report Tuesday, one of the big unanswered questions was whether the iPhone could maintain its sales momentum.

Q1 2015 iPhone sales hit a record 74.5 million units, and it's possible the latest quarter's shipments may not equal -- let alone exceed -- that mark.

IDC has forecast of slowing sales industrywide for 2016. The smartphone market will see the first single-digit growth year ever.

The slowdown in China's economy, weak demand for the iPhone 6s and 6s Plus, and sluggish Apple Watch sales are also of concern.

However, "we think sales are actually going to be up in volume this year compared to a year ago," said Jeff Orr, a senior practice director at ABI Research.

First, China is still a great opportunity despite the slowing down of its economy, and second, the iPhone 6s and 6s Plus were launched "a little later than iPhones used to be launched previously, so we aren't sure whether or not they'll hinder Apple's quarter," he told the E-Commerce Times.

Great Expectations

Apple historically has exceeded analysts' expectations while playing down its performance prior to releasing its earnings reports.

FactSet StreetAccount estimated Apple sold 75.5 million iPhones in the quarter -- surpassing the previous year's record by about 1 million units, according to news reports.

FBR, which slashed its estimates for iPhone 6s sales in December, earlier this month predicted a huge uptick for the upcoming iPhone 7 and dismissed investors' fears about slowing growth at Apple as being overblown, while acknowledging the company has been through a rough patch.

The market agrees -- Apple shares were up by US$1.28 to $100.72 at the time of writing.

"Should we expect any company to keep setting records year over year? The answer is no," Orr said. "The problem Apple has is that investors always expect it to show a meteoric performance. The question is, at what point do you become disgruntled because you don't get meteoric performance out of the company?"

Leveraging Preowned Phones

Sales of refurbished smartphones are taking off, and Apple has ventured into this area.

Refurbished iPhones "can be sold in price-sensitive but growing markets without any brand dilution," pointed out Andreas Scherer, managing partner at Salto Partners.

"It could be tempting to develop a cheaper product that's being sold utilizing a different brand name in order to win in Africa, India and Indonesia, but the better strategy is to sell refurbished iPhones," he told the E-Commerce Times.

Grabbing Market Share

In the future, the replacement business will outpace the new phone business, ABI's Orr suggested.

"For Apple the issue no longer will be offering items good enough for first-time buyers to purchase an Apple product; it will be about getting Android or Microsoft phone users to switch," he explained.

It's "getting increasingly difficult to get that kind of differentiation, but that's not just an Apple problem. It's the same thing Samsung has been facing over the past two years and being hammered by investors over," Orr said.

Where Apple Might Go

Apple "needs to continue to win in its core markets," Scherer observed. That means "relentlessly focusing on replacing existing iPhones with newer versions" in markets such as the United States, and introducing upgrade incentive programs and incentives to buy additional phones as part of family plans through carriers.

Perhaps Apple could move away from its image as the largest manufacturer of smartphones, Orr said.

"We're hearing talk about moving the audio jack and creating a new accessories market that's exclusive and led by Apple -- Beat headphones and other products using the Lightning connector or wireless interfaces," he elaborated.

Other possibilities for Apple are wireless charging, improving battery life, wraparound screens, incorporating OLED technologies, and making iPhones "more user-proof and water-resistant," Orr suggested.


Source by: http://www.technewsworld.com

Rugged Turing Phone to Run on Sailfish OS, Not Android

Turing Robotic Industries this week announced that it has uninstalled Google's Android mobile platform in favor of Jolla's Sailfish OS in its yet-to-appear secure smartphone.

The Turing Phone, molded from a single unit of the Liquidmorphium liquid-metal alloy, is designed to be more durable to absorb shocks and prevent screen breakage.

Preorder pricing ranges from US$610 for the 16-GB version to $870 for the 128-GB model.

Optimized for Swiftness

TRI started taking preorders for the smartphone last year. It delayed the planned shipping date of Dec. 18 to resolve remaining developmental steps for the device, including its security platform and operating system. The new projected shipping date is in April.

Customers found out about the OS switch this week through an email.

The Sailfish OS is optimized to run fast on the Turing Phones and the Snapdragon 801 processor, according to the notice.

"It has a super-secured platform environment, which Android lacks, and it does not use Java for UI (Android). So Turing targets design-savvy users and those who care about their privacy," said Steve Chao, CEO of TRI.

Google Play Store apps and Android apps in general will run on the Sailfish OS via the Alien Dalvik engine. User experience with Android will not be impacted, he told LinuxInsider.

Sailfish vs. Android

The Sailfish OS is a continuation of the Linux MeeGo OS, which was developed by an alliance of Nokia and Intel. The MeeGo mobile software platform was created through the merging of Moblin and the Maemo OS, which was developed by Nokia, according to Turing officials.

"TRI decided to use Sailfish OS because it has a long-term plan to build a trustworthy communications network. Sailfish is based on a pure mobile Linux platform with unmatched speed and with great performance," Chao said.

The decision was not made from a comparison with Android. Rather, the goal is to enable TRI to build an ecosystem around its own devices. The Turing Phone is just one example, he said.

"Sailfish is the perfect platform in which Turing may start building its ecosystem surrounding the IoT and the Future Networks (ISO/IEC 29181)," Chao said.

Tarnished Efforts

It's hard to understand why Turing would swap out the mature Android distro it originally promised. Sailfish is too new to know how it will perform, according to Charles King, principal analyst at Pund-IT.

"Turing claims it's the fastest mobile OS in the market. That may matter since the Turing Phone is running a 2-year-old CPU. While Sailfish is capable of supporting Android apps, early reviews have also noted significant glitches," he told LinuxInsider.

TRI may have discouraged potential buyers with the change in OS. The company got a lot of good press for its idea of shipping a highly durable and secure phone aimed at consumers.

"But the project's delays have tarnished the effort somewhat, and it is not clear how this latest twist will play among Turing supporters," said King.

Better Plan In the Works

The change in OS will have little impact on buyers' interest in the Turing Phone, Chao maintained. The phone will be unique and secure.

"Most Turing users went for Turing's unique design. The design was the most important part of their decision in purchasing it. Most of them were tired of the iPhone and the same looks that Android phones had to offer," he said.

The OS change strengthens the interest of Turing fans who sought a secured environment for mobile computing. Sailfish is the perfect answer to that, he said.

Security Factors

TRI developed a decentralized authentication technology that provides a dramatic improvement over the logic of identity-based encryption, according to the company.

Both the master public key and the unique private key are anonymously bundled into the phone. Each Turing Phone can directly verify the identity of other Turing devices without the need for a third-party key center, it said.

This complete authentication creates a protected communications network insulated from cyberthreats and privacy intrusions, the company said. This circle of trust lets users exchange sensitive data such as Social Security numbers or bank wiring instructions with the assurance the information will reach only the device intended.


Source by: http://www.technewsworld.com

Vaio's Phone Biz to Test Windows 10's Reception in Asia

Vaio on Wednesday announced Phone Biz, a Windows 10 mobile phone.

The device doesn't have a SIM, leaving users free to select their own carriers.

The Phone Biz lets users easily access corporate apps, Microsoft SharePoint and Microsoft Exchange, as well as the Azure cloud, according to Vaio.

The OS is synced with the latest version of Windows 10. Users can manage settings from the same Microsoft account as their PCs.

The Phone Biz incorporates Microsoft's Continuum feature, which lets users connect phones to TVs or monitors, if they want to work on a larger screen.

The Phone Biz supports single sign-on and connection speeds of up to 225 Mbps.

The position and size of tiles are customizable, and the phone comes with the Cortana digital assistant.

The phone can use encryption or a virtual private network. It includes built-in GPS and supports remote data erase and remote locking.

Admins can change users' access to apps and data remotely.

The Phone Biz will be available on NTT DoCoMo's network. It reportedly will begin selling in Japan in April for about US$430.

More About the Phone Biz

The Phone Biz has an aluminum body and a full high-definition tempered glass screen. It has a microUSB 2.0 port, said Vaio.

Four versions will be available. Two use eight-core 1.5-GHz Qualcomm Snapdragon 617 processors. One of them has a 5.5-inch 1080x1920 screen and the other a 5-inch 720x1280 screen.

The other two are 5-inch devices with 720x1280 screens. One has a 1.2 GHz quad-core processor and the other a 1.1 GHz quad-core processor.

RAM ranges from 1 GB to 3 GB, and internal storage from 8 GB to 16 GB.

Rear cameras are 8 MP or 13 MP, depending on the model, and front cameras range from 1 to 5 MP.

None of the features is particularly outstanding, said Mike Jude, a program manager at Stratecast/Frost & Sullivan.

However, "the Continuum capability that allows the phone to serve as a platform or CPU for a desktop ... makes the Vaio phone better suited for business use than personal use," he told TechNewsWorld.

"With Sony, it's all about design, so this phone is incredibly good-looking," said Rob Enderle, principal analyst at the Enderle Group.

Sony has a minority stake in Vaio, which it spun off in 2014.

Alternative platforms often work far better in Asia than they do in the U.S., Enderle told TechNewsWorld. The Asia-Pacific region as a whole "is more accepting of diversity, making it a far better geography to launch a phone like this."

Fighting an Uphill Battle

Worldwide smartphone shipments hit a record in Q4 2015, totaling nearly 400 million units, IDC reported. That is nearly 6 percent higher than the same quarter in 2014. As a whole, 2015 was a record year for phone shipments.

However, the Windows Phone OS' share of the market has been hovering around 2 percent since March, according to Netmarketshare.

That hasn't deterred Microsoft, which last fall announced that several Japanese companies would be making Windows 10 phones.

That said, Windows Phone "never really caught on that much, because it's highly dependent on a very good network connection," said Frost's Jude. "With active tiles, you need a reliable data connection and, if you're roaming, that might be hard to come by."

The current push in Japan indicates Microsoft is "fighting for a beachhead and have found Asia a far better geography to get one," Enderle said.

Microsoft "isn't giving up on mobile as the SwiftKey purchase clearly showcases," he noted. "It's looking for a geography to take back and use as a springboard to once again become relevant in this space."


Source by: http://www.technewsworld.com

FBI Director Makes Case for Security Trade-Off in Congressional Hearing

FBI Director James Comey on Tuesday testified before the House Judiciary Committee that the government has the legal right to gain limited access to the iPhone of one of the San Bernardino, California, shooters and other suspected terrorists.

Congress and the judicial system can create a mechanism to protect the safety of the American people while preserving constitutional rights against government overreach, he said in prepared testimony.

New methods of electronic communications have transformed society, Comey noted, adding that he supports the creation of strong encryption technology that protects large institutions and private citizens against cybercriminals and others who might attempt to gain access to proprietary data.

At the same time, terrorists and others criminals have used this technology to stay one step ahead of law enforcement, he said.

"We have always respected the fundamental right of people to engage in private communications, regardless of the medium or technology," Comey testified. "Whether it is instant messages, texts or old-fashioned letters, citizens have the right to communicate with one another in private -- without unauthorized government surveillance -- not simply because the Constitution demands it, but because the free flow of information is vital to a thriving democracy."

Clear and Present Threat

However, groups like the Islamic State have used social media to recruit and radicalize individuals to commit terrorist acts, he warned. Law enforcement needs additional tools to gather evidence to prosecute cases and in some instances prevent the acts from occurring.

The FBI is seeking only limited steps from Apple to help it open the San Bernardino shooter's encrypted iPhone. It wants the ability to bypass the encryption and spread out the time between individual attempts to guess a password, Comey said during a question-and-answer session with House members.

He likened the request to removing a group of guard dogs so that investigators could access the iPhone and get enough time to essentially break into the device themselves.

Asked repeatedly if the FBI had gone to other private companies or agencies to try to use alternative methods for unlocking the phone, Comey admitted that he was not an expert on the technology and that the FBI and other agencies had been stymied in their attempts to break into the phone.

Agency Assistance

The FBI asked San Bernardino County, where the shooter was employed, for assistance in retrieving data from the iPhone in December, county spokesperson David Wert said.

"The statements that have been made contending that resetting the Apple ID password is what made the backup impossible are incorrect. The fact that the phone was off and PIN locked is what made a cloud backup impossible before the Apple ID password was reset," he told the E-Commerce Times.

An iCloud backup requires a WiFi connection, and an iPhone that's turned off won't link to WiFi until the phone is unlocked, Wert said.

"At that point, the county said the best that could be done was to check the cloud for any past data uploads, but we would need to reset the Apple ID password because no one knew it. The FBI asked the county if it would do that, and the county agreed, unlocking the cloud and providing the FBI with the data that was in the cloud," he said.

Can of Worms

Granting the backdoor software request in the San Bernardino case will open the door for countless other requests by the Department of Justice -- and foreign governments -- in far less important circumstances, according to Eli Dourado, director of the Technology Policy Program at the Mercatus Center at George Mason University.

"This isn't a trade-off between security and privacy -- it's a trade-off between two kinds of security," he told the E-Commerce Times. One type of security is the kind provided by the FBI; the other is the security that iPhone users can get from encryption on their phones.

"In a world with repressive regimes as well as cybercriminals, the latter takes on greater importance," Dourado said.

A U.S. magistrate judge in New York ruled Monday that Apple did not have to assist the government in accessing the phone of a drug dealer whose encrypted iPhone was seized along with other mobile devices in a 2014 raid by the U.S. Drug Enforcement Agency.

The government did not have the legal authority under the All Writs Act to make Apple provide a way to bypass the encryption built into the phone and give law enforcement the ability to search for additional evidence, the judge ruled.

The dealer in that case pleaded guilty last year, and any new evidence would be used at sentencing or to pursue co-conspirators or others involved in the drug ring, according to court documents.

"We are disappointed in the magistrate's ruling and plan to ask the district judge to review the matter in the coming days," DOJ spokesperson Emily Pierce said.

"As our prior court filings make clear, Apple expressly agreed to assist the government in accessing the data on this iPhone -- as it had many times before in similar circumstances -- and only changed course when the government's application for assistance was made public by the court," she told the E-Commerce Times.

"This phone may contain evidence that will assist us in an active criminal investigation," Pierce added, "and we will continue to use the judicial system in our attempt to obtain it."


Source by: http://www.technewsworld.com