Gmail app hack works 92 percent of the time

Computer scientists have discovered a method of hacking smartphone apps across Android, iOS and

Windows devices that is effective up to 92 percent of the time on six of seven popular apps, including Gmail.

The method, reported in a paper to be presented at Friday's USENIX Security Symposium in San Diego, involves exploiting GUI state changes common in every major smartphone operating system. Testing their method on Android, an innocuous, unsigned app -- such as a wallpaper changer -- carrying malicious code is first installed on the user's phone.

The code monitors a newly exposed public side channel, which details the shared memory statistics of other processes. By using changes in these statistics, the researchers from University of California Riverside were able to determine specific "activity transition events" like a user logging into Gmail, or taking a picture of a cheque to deposit through the CHASE banking app.

Camera Peeking Attack on Chase AppQi Alfred Chen

Once they knew a target phone was entering one of these activity windows, the researchers then made attack timings to allow them to inconspicuously enter the app at the exact time it is vulnerable and extract pertinent data. In the case of the CHASE app, they were able to take control of the camera at the exact time a photo was taken for the banking app and force it to take a second picture of the cheque in order to send it to themselves.

Among the apps the hack was successfully used on were Gmail (92 percent success), H&R Block (92 percent), Newegg (86 percent), WebMD (85 percent), CHASE Bank (83 percent) and Hotels.com (83 percent). The team also tried the method on Amazon's app but were only able to achieve a 48 percent success rate. They explained that this was due to the way Amazon's UI transitions function, in that at any point the user can enter any other UI state, making it very difficult to predict where they are in the app from the memory statistics.

The team, led by assistant professor of Computer Science and Engineering Zhiyun Qian, hopes that by presenting their findings, these side channels will become more tightly regulated or closed off. His advice until then? "Don't install untrusted apps."

Source: http://www.wired.co.uk

Yahoo and Google to collaborate on encrypted email

Yahoo and Google are to join forces to create an encrypted email system that cannot even bedecrypted by the companies themselves.The system, which should be ready by next year, will supposedly make it impossible for governments or hackers to gain access to users' emails. Most of the battles on this front have so far been spearheaded primarily by open-source communities and those that have spoken out staunchly in defence of personal privacy and against government surveillance.

According to the Wall Street Journal, Yahoo didn't even have a senior management-level executive dedicated to information security until February of this year, but the fact that Google and Microsoft have both pledged to work on encrypted email is no doubt exerting pressure on smaller providers to up their game. Yahoo claims to have 110 million unique email users, which is around a quarter of those boasted by Microsoft, which has 400 million active Outlook and Hotmail users, and Google, which boasts 425 million Gmail users.

Clearly the time has come for big companies like Google and Yahoo to bring advanced privacy technology to those who have ultimately lost faith in the industry's willingness to keep personal correspondence private. Following the revelations contained in documents leaked by Edward Snowden that tech companies were complicit in helping the NSA's spying activities, this marks a huge turnaround. But the relationship between governments and big tech companies now seems to be severely strained.

Encryption will apparently be an optional feature of Google and Yahoo's service and will rely on PGP, meaning that customers will store their own encryption keys. It seems that rather than encryption running through the core of the service, it will work as a plugin.

In the past PGP-encrypted email has been difficult to use, so in one respect it's good to see mainstream companies making it more accessible. But while the content of messages will be harder to get at, it's important that companies explain clearly to their customers exactly what they are protecting. For one thing, it is only the content of email messages that will be encrypted, not the data about who messages are being sent and received by. It's necessary to remember that this kind of data is still of interest and value to spy agencies.

By providing users with an encrypted email service, it may well be the case that Google, Microsoft and Yahoo will no longer be able to comply with government requests to hand over content of emails. No doubt this will cause legal wranglings, but in trying to undo the damage that the Snowden revelations have inflicted on their reputations and customer relationships, the companies will hopefully.

SOURCE

Mozilla expands advertising experiment to many more Firefox users

Mozilla is beginning a broader second phase of an experiment to show ads to Firefox users, a move

that ultimately could help reduce the organization's reliance on revenue from Google.

The first phase of its program, called directory tiles, gave Mozilla the option to show ads or promoted content in a grid of thumbnail images that appear when a user opens a new browser tab, but it's offered only to new Firefox users. Enhanced tiles, though, are for existing Firefox users. The new feature gives publishers an opportunity to replace a thumbnail users already would see with one that's potentially more engaging, said Darren Herman, Mozilla's vice president of content services.

The program could give Mozilla more breathing room. Its share of desktop browser usage is slipping, and its presence in mobile browsing is miniscule, so Mozilla needs new levers to push its agenda. The sponsored tiles could mean more money for Mozilla and a new way to influence how advertisers use the personal data of those who see and click on ads.

The directory tiles are links Mozilla picks on its own, but the enhanced tiles modify links that the user already would see. Instead of seeing an automatically generated thumbnail image that might represent the site poorly -- a login screen, for example -- an enhanced tile would show imagery that looks and works better.

"We're looking at logos, images, or anything related to that site," Herman said.

Showing ads and promoting sites is a significant departure for Mozilla. Today, the nonprofit organization gets the vast majority of its money from Google when Firefox users send the search engine traffic that results in revenue from search ads. The ads would mean a new, potentially much broader source of revenue, though.

Money for Mozilla

"We do see it as an opportunity for us to recognize the value we're bringing to all constituents in the market," Herman said -- in other words, to get paid for Firefox's influence over what people see. "Directory tiles and enhanced tiles are an opportunity to work with marketers and content owners to help them distribute their content."

More revenue doesn't hurt, but Mozilla has bigger ambitions: it hopes the tiles program will revive its influence in the advertising world. The company has had fraught relations with advertisers in the last two years due to its push for a Do Not Track standard that lets people inform Web publishers and advertisers when they don't want their online behavior tracked. Mozilla hopes its tiles program ultimately will "make the Internet healthier," Herman said.

"We're showing the world you can get into the advertising ecosystem, building trust, transparency, and user control into those experiences," he said. "Forty-three billion dollars are spent in online ads every year. The opportunity for us is to clean the Web up, to make it healthier...We have to participate. We can't just sit on the sidelines telling people what to do."

Enhanced tiles arriving soon

The new feature should arrive "in the next couple weeks" for users of Mozilla's pre-release beta and Aurora versions, said Johnath Nightingale, Mozilla's vice president of Firefox.

Enhanced tiles aren't a vehicle for publishers to place ads of their own, Herman added.

"We don't necessarily see the new-tab page as being a window shop. We see it as a content distribution platform...We're working through creative specs to say what publishers can and can't do."

To help steer things what it sees as the right direction, Mozilla will offer a discounted rate to those whose advertising agenda matches Mozilla's.

"Partners who are good actors -- respecting Do Not Track and other areas of the Web we believe fits our mission around innovation, opportunity, and trust -- will get a discount," Herman said. "Not only is this a media content opportunity, it's an opportunity for Mozilla to push our mission forward and reward our partners that are like-minded."

Early directory tiles results

The directory tiles experiment, which is now still limited to people using Mozilla's pre-release versions of Firefox, has shown promise in its early days, according to Nightingale. He said that users are clicking the tiles and sometimes pinning them so they remain a fixture in the browser interface.

Examples of what tiles Mozilla shows include mainstream consumer sites like Facebook and YouTube; non-profit organizations such as Wikipedia; and Mozilla's own sites like Webmaker.

"People are interacting with this much more than with blank white tiles. Some [tiles] have a 5- to 6-percent click-through rate," meaning that five or six out of every hundred users click the directory tiles, Nightingale said. But other sites are only a fraction of a percent, he said.

And Mozilla will keep measuring to make sure the program is a good idea for all Firefox users.

"We're going to do this or not [based on] whether it's valuable to users," Nightingale said.

Source