Tuesday

,
camera security

GeoVision, a Taiwanese manufacturer of video surveillance systems and IP cameras, recently patched three of the four critical flaws impacting its card and fingerprint scanners that could’ve potentially allowed attackers to intercept network traffic and stage man-in-the-middle attacks.

In a report shared exclusively with The Hacker News, enterprise security firm Acronis said it discovered the vulnerabilities last year following a routine security audit of a Singapore-based major retailer.

“Malicious attackers can establish persistence on the network and spy on internal users, steal data — without ever getting detected,” Acronis said. “They can reuse your fingerprint data to enter your home and/or personal devices, and photos can be easily reused by malicious actors to perpetrate identity theft based on biometric data.”

In all, the flaws affect at least 6 device families, with over 2,500 vulnerable devices discovered online across Brazil, US, Germany, Taiwan, and Japan, aside from thousands of other devices capable of being remotely compromised.

The first issue concerns a previously undocumented root password that permits an attacker backdoor access to a device by simply using the default password (“admin”) and remotely log in to the vulnerable device (e.g., https://ift.tt/3fXQEA6).

A second flaw involves the use of hardcoded shared cryptographic private keys when authenticating via SSH, while a third vulnerability makes it possible to access system logs on the device (e.g., at https://ift.tt/2ZcbNzM and at https://ift.tt/2ZaRhPY) without any authentication.

Lastly, there exists a buffer overflow vulnerability in the firmware impacting GeoVision’s fingerprint readers that allows attackers to run unauthorized code on the devices. It requires no prior authentication. Even more troublingly, it has a CVSS rating of 10, making it a critical flaw.

Acronis said it initially approached GeoVision last August, subsequently twice in September and December, in addition to contacting SingCERT with their findings. But it wasn’t until early this month that GeoVision issued fixes for three of the flaws (version 1.22) while leaving the buffer overflow vulnerability unpatched.

The flaws were also acknowledged by Taiwan’s Computer Emergency Response Team (TWCERT), which published advisories for the three bugs — CVE-2020-3928, CVE-2020-3929, and CVE-2020-3930 — confirming the firmware fixes and the availability of the new version.

Besides this, without disclosing technical information on the fourth critical remote code execution flaw that the company left unpatched, we can mention that it could let attackers leverage a vulnerable parameter to overwrite memory structures responsible for memory management.

The flaw eventually overwrites the pointers in particular structures, allowing attackers to redirect the program’s execution flow to their own malicious code and perform different commands.

We have reached out to GeoVision to ask for their comment on the disclosures, but we did not receive a response before this article’s publication.

“Once the attacker gets full control over the device, he/she is free to install their own malicious firmware — after which it will be almost impossible to evict them from the network,” Acronis CISO CISO Kevin Reed and Security Researcher Alex Koshelev said.

“It’s quite surreal seeing some vendors not rushing to fix critical vulnerabilities — in addition to the low quality of the initial source code, the presence of back doors is concerning. It shows that IoT security is flawed, and each company must understand that using such devices can leave them exposed to prolonged unmitigated risks.”

Source link

,

Translation is an everyday smartphone task for millions of people, but outside a few minor features, Apple has generally ceded the capability to its rivals. That changes today with a new first-party iOS app called, naturally, Translate, which works with 11 languages, no internet connection required.

The app is intended for use with speech or short written sentences, not to translate whole web pages or documents. The interface is simple, with a language selector, text field and record button as well as a few extra widgets like favorites and a dictionary.

At launch Translate will support English, Mandarin Chinese, French, German, Spanish, Italian, Japanese, Korean, Arabic, Portuguese and Russian, with others to come. You simply select a pair of languages and paste or record a snippet of text or audio. The translation should show up immediately.

There’s also a landscape mode that further simplifies the interface:

Image Credits: Apple

The best part is that unlike many translation apps out there, Apple’s is entirely offline, meaning you can use it whether you have a good or bad signal, if you’re out in the middle of nowhere in a country where you don’t get service or if you’re just trying to save data.

There were no specific release details, so the app will probably appear when you upgrade to iOS 14.

Source link

,

Handwashing for the Apple Watch happily slotted alongside face masks for Memojis in the list of COVID-19-related features the company introduced at last week’s WWDC keynote. It’s a pedestrian action, something we take entirely for granted the several times a day we do it. Over the past five months, however, handwashing has taken on a kind of central importance to our daily lives — something to focus on and obsess over.

We all read the WHO and CDC guidelines and shared (and perhaps even created) some of the millions of song lyric memes highlighting the proper length of time required to sufficiently clean one’s hands and avoid virus transmission. We’ve all also become painfully aware of just how long 20 seconds can feel when you’re standing in front of the bathroom sink.

Unlike other rush initiatives undertaken by the company once the virus hit, however, the forthcoming Apple Watch handwashing app wasn’t built overnight. The feature was the result of “years of work,” VP of Technology Kevin Lynch told TechCrunch. In typical Apple fashion, the product was a result of years of trial and error, according to the executive.

Image Credits: Apple

Certainly it’s not the first smartwatch app to tackle this one banal action. Samsung was quick to the market to introduce a Galaxy Watch app designed for users wash their hands for the allotted time. But Apple’s version slots alongside such health features as the Noise app, and leverages the device’s built-in sensors to provide clever applications that contribute to the wearable’s overall health focus.

The feature, which is built directly into the forthcoming version of watchOS, is designed to work like fitness tracking in a number of ways. For starters, if the user opts into it, it’s designed to automatically trigger when handwashing is detected, starting a countdown timer of 20 seconds. The accelerometer is the key piece of hardware here, waiting for the specific handwashing pattern — which apparently adopts a number of different methods, depending on who’s actually doing the scrubbing.

The system uses machine learning models to tackle different methods, but the system gets an additional nudge from the Watch’s microphone. Along with motion, the app listens for the sound of running water. Even that’s not enough, though — after all, eco sinks have become increasingly popular, meaning that there’s often less water sound to be listening for. The sound of squishing soap takes care of that last bit. It’s got a unique enough audio signature so as to confirm that handwashing is taking place.

The feature flashes images of soap bubbles and buzzes the watch’s haptics to encourage the wearer to go the distance — offering “polite encouragement” if they pause. Like fitness tracking, that information is recorded in Apple’s health app. Again, what might otherwise feel like a silly little feature is suddenly taking on a much deeper importance as suddenly we all find ourselves obsessing over germ transmission.

The feature inadvertently joins a number of other COVID-19-related initiatives from Apple introduced over the past several months. The company has donated masks and built face shields and been a key player in contact-tracing initiatives.

Image Credits: Apple

On the Watch front specifically, it has opened remote usage for doctors looking to monitor patients’ ECG readings without risking exposure to the virus for either party. Apple currently makes no claims about the Watch’s potential for helping to diagnose the virus, however. “While we haven’t studied specifically how Apple Watch can track COVID, we’re happy to support the research the medical community is doing. We really support their initiatives by enabling our colleagues in the space, and we’re excited to see what they learn,” Apple’s VP of Health, Sumbul Ahmad Desai, tells TechCrunch.

The company doesn’t have anything specific to share on that front, at the moment, but it’s easy to see how researchers would be interested in leveraging such a widely used wearable in the detection and diagnoses of such a viral and deadly disease. Back in May, Fitbit announced that it was in the early stages of working with researchers on precisely that.

Source link

,

One of the world’s best selling wearable lineups just added a new gadget to the mix.

Chinese electronics giant Xiaomi today unveiled the Mi Smart Band 5 that delivers several improvements and adds features, such as a bigger screen, new wireless charging system and women’s health mode over the company’s one-year-old Mi Smart Band 4 — while retaining its dirt-cheap price point.

The Mi Smart Band 5 features a 1.1-inch AMOLED display that is 20% larger than the one its immediate predecessor sported.

With the new band, the world’s second largest wearable vendor is also bringing a range of new animated watch faces, including characters from TV series such as Spongebob Squarepants, Neon Genesis Evangelion and Detective Conan, and eight colorful straps.

Xiaomi says the new smart band is powered by an improved processor — the name of which it did not specify — to enable tracking of menstrual cycles for the first time, and support additional features such as stress assessment that will tell the wearer when it’s a good time to relax.

The Mi Smart Band 5, compatible with iPhones as well as Android handsets, also monitors the wearer’s sleep cycle more efficiently now, adding support for REM sleep as well as evaluating deep and light sleep sessions. The company claimed its heart-rate monitoring is now 50% more precise.

One of the biggest improvements in the new band is its new charging system. This is a refreshing change as previous models in Xiaomi’s Mi Smart Band lineup have received complaints from users who described having to get the tracker out of the strap as a clumsy process. Now the company says its new magnetic charging dock automatically snaps onto the bottom of the band. Charging the band once delivers up to 14-days of continuous usage.

Like the Mi Smart Band 4, the Band 5 supports the company’s homegrown digital voice assistant XiaoAI that a user can trigger by swiping to the right of the display.

There is an additional variant of the Smart Band 5 that supports NFC. This model features support for mobile payment services, and can be used to unlock smart doors and also serve as a transportation card at select subways.

The Mi Smart Band 5 goes on sale in China next week at a price point of RMB 189 ($26.75) while the NFC variant of the band is priced at RMB 229 ($32.5). The company says the device will be made available in international markets “soon.”

Xiaomi continues to be one of the leading players in the wearable market as it aggressively refreshes and introduces new devices. In November last year, Xiaomi debuted its first smartwatch — called the Mi Watch —  that looks strikingly similar to the Apple Watch. The Mi Watch is priced at $185.

According to research firm IDC, the company shipped 10.1 million wearable devices in the quarter that ended in March this year. It is ahead of Samsung, Huawei and Fitbit. Apple maintains its top spot in the category.

Data: IDC

Source link

,

Apple has announced a major shift for the Mac. In the future, the company is going to switch from Intel CPU to Apple’s own silicon, based on ARM architecture. If you are a developer or if you run obscure enterprise apps, you may have a lot of questions about how it’s going to work.

First, you’ll be able to compile your app to run both on Intel-based Macs and ARM-based Macs. You can ship those apps with both executables using a new format called Universal 2. If you’ve been using a Mac for a while, you know that Apple used the same process when it switched from PowerPC CPUs to Intel CPUs — one app, two executables.

As for unoptimized software, you’ll still be able to run those apps. But its performances won’t be as good as what you’d get from a native ARM-ready app. Apple is going to ship Rosetta 2, an emulation layer that lets you run old apps on new Macs.

When you install an old app, your Mac will examine the app and try to optimize it for your ARM processor. This way, there will be some level of optimization even before you open the app.

But what if it’s a web browser or a complicated app with just-in-time code? Rosetta 2 can also translate instructions from x86 to ARM on the fly, while you’re running the app.

And if you’re a developer working on code that is going to run on servers, Apple is also working on a set of virtualization tools. You’ll be able to run Linux and Docker on an ARM Mac.

As a bonus, users will also be able to access a much larger library of apps. “Mac users can for the first time run iOS and iPadOS apps on the Mac,” Apple CEO Tim Cook said.

While the company didn’t share a lot of details, Apple isn’t talking about Catalyst, its own framework that makes it easier to port iOS apps to macOS. You should be able to download and run apps even if the developer never optimized those apps for macOS.

The transition is going to take a while — around two years. The first ARM-based Mac will ship by the end of the year. There will be a quick start program for developers interested in porting apps to ARM-based Macs. In addition to documentation and a private forum, Apple will send you a custom-made Mac Mini with an A12Z system on a chip. This way, you can test your apps on an actual Mac with an ARM chip.

Source link

Follow Us @soratemplates