Android pwned. Again.

Two huge security holes in Android this month.  First up was last week's Master Key vulnerability:

A four-year-old Android bug could be used to plant malware on 99 per cent of Android devices on the market, according to security researchers.

Bluebox Security CTO Jeff Forristal said the vulnerability in Android’s security model creates a means for hackers to modify an Android app's APK code without breaking its cryptographic signature.

This means that any legitimate application - even those afforded elevated privileges by the device manufacturer - could be turned into a malicious Trojan before being offered for download. The difference between the two would not be readily detectable by either the smartphone or the app store - much less an end user.

You see what's coming next, don't you?

Google Play alert: An information security researcher has spotted two apps that use the master key vulnerability that's present in an estimated 99% of all Android devices. But rather than being distributed by sketchy third-party app stores, which are known for harboring malicious apps that have been disguised as free versions of the real thing, these two apps are available directly from the official Google Play app store.


Fortunately, the apps don't appear to be malicious. But the presence of the free apps -- Rose Wedding Cake Game and Pirates Island Mahjong Free, which have been downloaded by between 15,000 and 60,000 people -- on the Google Play site calls into question whether Google is now scanning for apps that abuse the so-called master key vulnerability that was discovered by Bluebox Labs in February and detailed by Android hackers earlier this month

Doesn't take long for something this big to get out in the wild.  And now there's a second vulnerability that the Bad Guys can play with:

Hot on the heels of the so-called "master key" hole in Android comes what Chinese Android researchers are calling "a similar vulnerability."


They've definitely found a bug, and an another embarrassing one for Google's coders, too.

Pretty heavy duty geekery there.

The real problem isn't that Android has vulnerabilities - after all, everything has vulnerabilities.  The problem is that the process of getting a fix from Google to you is broken.  With an iPhone, Apple releases a patch, iTunes checks for it, and downloads it straight from Apple for you.  It doesn't matter who your carrier is - AT&T, Verizon, T-Mobile, Orange: macht nichts.

It's different with Android.  Google releases a fix, and sends it to the handset manufacturer (e.g. Samsung).  At some time in the future, Samsung includes the fix and sends it to the carriers (e.g. AT&T).  After another delay, AT&T updates the image for your Galaxy S.  Maybe.  Then you can get it.

Fail.  It's so bad that some security dudes created a hotpatch app that you can (and should) download from the Google Play store:

Jon Oberheide, CTO of Duo Security, told El Reg that ReKey provided notification of attempted attacks featuring dodgy APKs as well as blocking the Bluebox master key and similar malware padding attacks.

...

"Since ReKey only patches in-memory (and then re-patches upon boot of the device), it is non-destructive and makes no permanent changes to the user's device. When the official patch is delivered to the device, it can interoperate peacefully."

The ReKey app was released on Tuesday and is available to download at rekey.io as well as through the Google Play Store.

A blog post by Duo Security with more context and technical information about ReKey can be found here.

"The security of Android devices worldwide is paralysed by the slow patching practices of mobile carriers and other parties in the Android ecosystem," Oberheide concluded.

Quite frankly, the whole situation shows that the Android security model is a train wreck.  I can't in good conscience recommend that anyone use Android until the patch distribution process gets under control.

On evil

Sabra muses on the Rolling Stone's glam cover shot of Jahar Tsarnaev and reminds me why I read her every day:

The problem seems to be that, by failing to dehumanize a murderer, he is somehow being glorified.  Which is, of course, patently ridiculous.

Look, murderers all have one thing in common, beyond the obvious: they're human.

Evil is human.  Uniquely human, perhaps.  Animals kill for food, and they kill for dominance, but they don't kill for ideology or jealousy or momentary passing anger.  Humans do all of those things.


But we don't like to admit that. 

...

Susan Smith didn't go around torturing animals; she was from all accounts a devoted mother, right up until she wasn't.



And Jahar Tsarnaev was a nonviolent, chill dude right up until he wasn't.

That's one smart lady.  RTWT.

Let's go back in time

I must confess that this is a hugely guilty pleasure for me; from an age where people were still figuring out how to shoot music videos*, when I was in my twenties (barely), had hair almost as good as Huey (almost), and when life was simple.  And had a shirt exactly like his in both videos).  Good times,good times.



This is the point where people roll their eyes at me.  I don't care.  Srlsy.  Because it's hip to be square.



Yes, I cut my hair.

* When people still shot music videos.

Science. That's gangsta.

Well that's your problem right there

Well played.

Tech Sector business hit by NSA spying

Silicon Valley is already feeling the business impact of the NSA data gathering effort:

Will overseas business owners think twice about trading with us because they fear that their communications might be intercepted and used for commercial gain by American competitors? Most chilling of all: Will foreigners stop using the products and services of California technology and media companies — Facebook, Google, Skype, and Apple among them — that have been accomplices (they say unwillingly) to the federal surveillance?

The answer to that last question: Yes. It’s already happening. Asian governments and businesses are now moving their employees and systems off Google’s Gmail and other U.S.-based systems, according to Asian news reports. German prosecutors are investigating some of the American surveillance. The issue is becoming a stumbling block in negotiations with the European Union over a new trade agreement. Technology experts are warning of a big loss of foreign business.

John Dvorak, the PCMag.com columnist, wrote recently, “Our companies have billions and billions of dollars in overseas sales and none of the American companies can guarantee security from American spies. Does anyone but me think this is a problem for commerce?”

This is slowing the rush to "Cloud Services".  I am hearing from people I talk to professionally that a lot of US companies are reconsidering public cloud services, too.  They specifically cite concern over whether the service provider might turn their data over to the Fed.Gov.

And the Government itself is turning away from this technology:

US government spending on cloud technology is set to spike in the next two years, though security concerns have scared agencies away from public clouds.

...

For all the federal government's push to adopt new technologies as part of a major IT refreshment strategy, agencies are still apparently concerned about the security and viability of public cloud technologies.

...

Although providers such as Amazon, HP, and Microsoft have pursued security certifications such as FISMA and FedRAMP – Amazon has set the pace in this area via its dedicated GovCloud data centers – many government departments are hamstrung either by regulation or legacy hardware from going into public cloud environments.

Nice return on Silicon Valley's political contributions last election cycle.

It seems that hardly anyone is buying "Smart" guns

And this seems to be a big mystery, at least to the Usual Suspects:

The technology is here. So-called "smart guns" are being programmed to recognize a gun owner’s identity and lock up if the weapon ends up in the wrong hands. Entrepreneurs and engineers have been developing technology to make safer guns since the early '90s, and by now we've got working prototypes of guns that read fingerprints, hand grips or even sensors embedded under the skin. But after 15 years of innovation, personalized guns still haven't penetrated the marketplace.

Why? Smart guns are caught in the crosshairs of a heated debate over guns, for one thing. Pro-gun groups see it as an attack on Second Amendment rights and, you know, freedom. Anti-gun groups worry that if guns are safer it will inspire more people to buy them. Perhaps more troublesome is that consumer demand just isn't there. “The gun industry has no interest in making smart-guns. There is no incentive for them,” Robert J. Spitzer, a political science professor at SUNY Cortland told the New York Times.

No incentive? What about saving lives?

Blast all those gun owners, withholding their market demand and refusing to save lives!

The comments are running 100% against the author, pointing out what could easily have been found out in any actual, you know, journalism effort: find people on both sides of the issue, get their view of the issue, write it down without misspelling anything.

I only point this out (other than for the amusement value of the comments section) as an illustration of the utter institutional incompetence of the media to provide basic reporting on firearms issues.  Even if they wanted to play it straight (which is a big question), they simply do not have the capacity to.

Driver's License, Class CM

In my wallet.  Now to finding a bike.  The local Harley dealer had a 2005 Sportster for under $5k, which is pretty tempting, especially since it has the rubber-mounted engine to reduce vibration.

Onward!

UPDATE 16 July 2013 18:58: Stretch email with this awesome Harley-Davidson accessory.  Want.

Bet ASM826 would go riding with that ...

Anyone going to the Black Hat/DEFCON security conferences?

It's July, which means that it's the security Silly Season, with lots of happenings at the Black Hat Briefings in Las Vegas.  I'm going this year, and taking #2 Son.  He's been dying to see Vegas, and having him with me will cut down on late night carousing with old security buddies.  We'll stick around for a couple of days of DEFCON, the "let your hair down and get your security Freak on" twin conference which is a nice compliment to the pretty corporate and button-down Black Hat.

It's the last week of July.  Anyone else who's going, drop a comment and maybe we can meet up there.  DEFCON has a shoot planned at one of the local ranges.

I did not know that

Isegoria (you do read him every day, don't you?) finds a delightful post about "fossilized" words in the English language, and where they came from:

1. Wend
You rarely see a “wend” without a “way.” You can wend your way through a crowd or down a hill, but no one wends to bed or to school. However, there was a time when English speakers would wend to all kinds of places. “Wend” was just another word for “go” in Old English. The past tense of “wend” was “went” and the past tense of “go” was “gaed.” People used both until the 15th century, when “go” became the preferred verb, except in the past tense where “went” hung on, leaving us with an outrageously irregular verb.

There are a bunch more, most of which I hadn't known.

Don't leave mad, A-Rod

Cheaters got to cheat.  And get caught, it seems:

Major League Baseball may have enough evidence against Alex Rodriguez in the latest performance-enhancing drug scandal that the New York Yankees slugger is looking to cop a plea deal. According to the NY Daily News, Rodriguez’s lawyers and MLB are having internal discussions about coming to an agreement on a 150-game suspension.

MLB’s policy on PED use would call for A-Rod to be suspended for 100 games as a repeat offender. However, the extent of Rodriguez’s involvement with Anthony Bosch’s Biogenesis clinic could be damning enough that the league would be seeking a lifetime ban, which would make a 150-game suspension an enticing middle ground for A-Rod.

Even the best cheater who ever played the game got caught.  So don't leave mad, even with this exit music (suggested quite some time ago by Chris Lynch).

Ode to the NSA metadata algorithm

Will this love be requited?  Only those with a clearance (and Need To Know) will ever know ...

How to save the Republican Party?

Foseti reviews Sam Francis' book Shots Fired and makes me want to read it:

The general theme that comes out of this collection of essays is Francis’ reaction to the rise of the neoconservatives. During this period, the Right of someone like Robert Taft was replaced by the Right of the neoconservatives. The triumph of the neoconservatives:

For the Buchananite Right, the Christian Right, the Old Right, the Hard Right, the paleo-conservatives, and the paleo-libertarians, [] will mean political oblivion, the final disappearance of any serious hope of influencing American politics in a direction away from the gargantuan state and the state’s alliance with both overclass and underclass against the middle, or in a direction toward dismantling the warfare- welfare state, controlling immigration, reversing the erosion of national sovereignty, withdrawing from the pursuit of a globalist-imperialist foreign policy, and restoring a Eurocentric cultural order.

...

I couldn’t agree more that the serious Right needs to work towards its own liberation from watered-down progressivism. Francis believes the solution is a populist Right. He notes several areas in which conservatism was actually successful during this period and notes that they were all areas in which mainstream conservatives were initially hostile to the views of the broad conservative populace:

On the issues of immigration, gun control, trade, and Big Government, mainstream conservatives and Republicans simply were on the wrong side of the emergent populism of the Right.

He also thinks that in attempting to make itself acceptable to the progressive elites, mainstream conservatism lost all its interesting thoughts.

There's no doubt that the GOP Establishment is violently opposed to populist conservativism, and there's also no doubt that the Tea Party movement is populist to the core.  If there's a path forwards, it seems that it must be through a populist revolt within the Republican Party, one that aims at breaking (in Francis' neat turn of phrase) the alliance between overclass and underclass against the middle.

6 things nobody tells you about pwning a motorcycle

Funny, although the bit about a bird building a nest in his helmet says that he's an idiot.  Also, the Georgia Legislature did not pass a law making it legal for bikers to proceed at a red light when they didn't trigger the sensor.  And I already knew this:

Like any club that has grown too large, it has become mired in vacuous debates and split into a thousand splinter factions. Older riders hate squids; cruisers hate sport riders; Harley riders hate everyone, including themselves. The social labyrinth is like navigating a high school prom, except you're sprinting through it at about 75 mph, on one leg, while programming a remote control and probably being attacked by bees.

Translation: your bike sucks and you're riding it wrong.

If you're going to do a Zimmerman, film yourself

I don't really have anything else to add.  My reasoning goes like this:

1. The media hates guns, and anyone who uses or carries one.  They'll try to take you down just for that.  This may in fact explain 100% of their attitude to Zimmerman.
2. The Media lies, especially about things that they hate (see #1).  They will do a Zimmerman on you, i.e. edit 911 calls and refuse to report your side of the matter.
3. Everyone already hates the Media.  Having a video record of the situation will let you release video for jurors and (more importantly) the public (via Youtube).  Who you gonna believe, the lying Media or your own eyes.

There's a selection of wearable video recorders.  I'd look for one that streams the video to somewhere in the Cloud, so that the Po-Po can't delete it.

Of course, if you're filming yourself, make sure you don't break any laws.  Duh.  But if you do this, you'll cool the Media's jets just by your lawyer announcing that video of the entire episode exists and anyone in the Media who doctors the recorded evidence will be sued for everything that they're worth.

When the existing institutions are corrupt, transparency is your friend.  Because I reject the "you're an idiot to get out of the car" argument.  This sums it up:

Everybody keeps calling George Zimmerman an idiot for getting out of his truck and thus causing what followed. It was a benign decision spurned on by a dispatcher's request for information. So can we stop?

Or do I get to tell rape victims they shouldn't have dressed that way, or walked down that street, or been out that late?

And this explains a lot, really:

Anyone see any riots?

I haven't seen or heard of anything around here, but I live in "flyover" country.

We don't riot 'til the bacon runs out, bitches.
Then you better lock up your hogs and load up your guns.

You should check out the cocktailblogging out over at that link.  Me, I recommend drinking heavily and enjoying the decline.

Just passed the Motorcycle Safety test

I think I went over the line driving a figure 8, but passed anyway. Georgia gives a waiver of the motorcycle road test if you've taken the test. So I just need to go to the DDS (MVA for all y'all in Yankeeland) to get my official license.

Yay, me. Adult beverages will be next.


- Posted using BlogPress from my iPhone

Reflections on riding

You can tell which of the people in the class have never driven a manual transmission. They are invariably young, no doubt a reflection on the decline of the west. One kid simply can't get it through his head to let the clutch out slowly. He pops the clutch and stalls, even after a full day yesterday on a bike.

Weaving through cones at speed is awesome. "At speed" is probably only 15 MPH, but second gear!!!!!11!!eleventy!

This sure looks like fun, too. The kids look like they're only 5 or 6. Best. Parents. Evah.




- Posted using BlogPress from my iPhone

Pyotr Ilych Tchaikovsky - Swan Lake

Dress up plays a part in many children's growing up.  One of the early pictures of your humble host is me in a Superman costume.  Dad was quick witted enough to grab the camera and snap the pic.  One of my favorite pictures of #2 Son is him in his Spiderman outfit, at about the same age as I had been those many, many years ago.  Dad loved that picture of his grandson, for that very reason.

But little girls don't get Superman or Spiderman.  Quite frankly, they don't need them; they have Swan Lake.

Here is not just Swan Lake, but the Swan Lake ballet, with dancers and everything.And not just dancers, but the Kirov Ballet.  The entire ballet.

You're welcome.

Yes, yes, I know that I'm sexist for not making #2 Son dance ballet rather than dress up as Spiderman.  Clearly Double Plus Ungood® Patriarchal® Oppressors®.  The West has clearly declined since those days, so long ago.



Bootnote: Note to Progressives who are appalled at the grotesque sexism of me and #2 Son (as a young boy): bite me.  And grow up and get a life.

Bootnote 2: Let me know if you want me to post the pix of young me and young 2 Son.  The apple doesn't fall far from the tree.

Ouch

We were on motorcycles for probably 5 hours today.  I'm aware of muscles that I didn't know that I had.

I also discovered the virtue of putting your wallet in your front pocket, rather than sitting on it when you're in the saddle.

The hardest thing, quite frankly, was using the clutch.  When I learned to drive (way back in the early '70s), it was "three on the tree" and my Dad hammered it into me that you do not ride the clutch.  On a bike, you pretty much do it all the time you're running at low speed.  Old instincts die hard.

Quote of the Day: Separation of Powers

Simon Grey looks at the intersection of the Founding Fathers, Snowden, and Obama's directive that Federal employees spy on each other:

The brilliance of this system, then, is that it basically allowed self-important men do things to make themselves feel important without letting them actually do a lot of damage.  Since these busybodies only really enjoy being busybodies, it was sheer brilliance to let them be busybodies while not tying it to real-world results.*  ...

And now Snowden has tricked the fool Obama into going right back down this same road.  Now federal employees will be watching each other, hopefully in the attempt to ruin each other’s lives over some petty feud.  And with federal employees watching each other and planning their various revenges and comeuppances, the American citizens will be largely ignored, and better able to go on with their lives, free of stupid federal intrusion.

Well-played, Mr. Snowden.  Well-played.

Awesome.

UPDATE 13 July 2013 19:04: Link added.