Color vulnerable to simple GPS hack, lets you spy on anyone, anywhere

Color, the $41-million-in-funding location-oriented photo sharing startup, is susceptible to simple GPS spoofing. With nothing more than a jailbroken iPad or iPhone, you can use FakeLocation to trick Color into thinking you're somewhere else. Within seconds you can be browsing photos that were snapped thousands of miles away. With a little digging, you can pore through photos not intended for your eyes.

Of course, such a hack isn't illegal as such -- every photo you take with Color is public. With FakeLocation you are simply circumventing Color's very limited location-oriented security mechanism. It does undermine Color's usefulness (and uniqueness), though -- if nefarious types can sit in their bedroom or basement and eavesdrop on classy dinner parties and wild night club soirees, people might be less inclined to share personal photos with those around them.

Fortunately, both for Color and its users, this is an easy security hole to plug -- at least in the short term. The app (or server-side) code simply checks to see if the user has 'teleported' an impossibly large distance, without any intermediate steps in between. In the long term, though, Color's users must be aware that its social graph is completely public. Color's users must realize that every photo they upload is visible by anyone, from any place.

After the break, just to elucidate a little on Color's actual business model and ultimate intention, we have two amazing quotes from Bill Nguyen, Color's founder.

Continue reading Color vulnerable to simple GPS hack, lets you spy on anyone, anywhere

Color vulnerable to simple GPS hack, lets you spy on anyone, anywhere originally appeared on Download Squad on Tue, 29 Mar 2011 05:36:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments

sucker punch mega millions chris brown

HTC Sensation arriving at retail locations across Canada

 

Been waiting for an HTC Sensation to arrive in Canada? Today just might be your day to get your hands on one. After having called local Bell and Virgin mobile locations I can confirm that most stores (At least, in my area) have now received their inventory. With the device not set to officially launch until July 5, you might want to try and score one a little early. Let us know if you do -- I tried but was advised I would have to take one under contract, not outright purchase it.

HTC Sensation Specs | HTC Sensation Forums | HTC Sensation Accessories

football russia 2018 the rock

MOG Rolls Out Slick HTML5 Player, With A New Emphasis On Recommendations And Playlists

The online music race is now an all-out sprint: Amazon, Google, and Apple are now all offering (or preparing to launch) services that let you upload your music collection to the cloud, letting you listen to the music you own wherever you are. But they aren't just competing with each other ?�another group of services that includes MOG, Rdio, and (eventually) Spotify lets users stream any song as often as they'd like for a reasonable monthly rate of around $10 a month. It's getting fun. And today, MOG is making the race all that much closer. The service has just rolled out a new Beta player to users that streamlines�the MOG experience, putting a much heavier emphasis on building out playlists and recommendations than its predecessor did.

jp morgan thomas jefferson aurora borealis

VeriFone's new Payware Mobile Enterprise for Tablets looks a little Square

VeriFone added a new wrinkle to its ongoing battle for mobile payment supremacy yesterday, with the announcement of Payware Mobile Enterprise for Tablets -- a peripheral that will allow retailers to process transactions directly from any slate. Much like the company's Payware Mobile system, VeriFone's latest product involves a magnetic card reader and accompanying app that can turn any iPad or Android tablet into a handheld checkout unit. Geared toward larger enterprises, the new device also supports PIN verification for debit cards and NFC payments, rendering it compatible with Google Wallet, though it likely won't see a widespread release until 2012. Perhaps more intriguing is what this move could mean for the company's notoriously heated rivalry with Square. By explicitly targeting bigger retailers, VeriFone seems to be distinguishing itself from the small business-focused Square, despite the fact that its new product looks a lot like one of Jack Dorsey's creations -- or, as some CEOs would call them, "skimming devices."

VeriFone's new Payware Mobile Enterprise for Tablets looks a little Square originally appeared on Engadget on Thu, 30 Jun 2011 11:02:00 EDT. Please see our terms for use of feeds.

Permalink Electronista  |  Bloomberg  | Email this | Comments

amy adams neiman marcus orlando weather

Mac OS X Lion Available in July from Mac App Store

Apple today announced that Mac OS X Lion ? the eighth major release of the world?s most advanced desktop operating system ? will be available to customers in July as a download from the Mac App Store for $ 29.99. OS X Lion offers more than 250 new features, including Multi-Touch gestures; systemwide support for [...]

julia stiles tmobile kansas city star

Gargantuan SQL injection infects 3.8 million URLs, installs rogue antivirus

Over the last few days, a mass SQL injection attack has been quickly gathering speed. Just three days ago only 28,000 URLs were affected, but at the time of writing, there could be up to 3.8 million infected URLs.

Websense has a complete write up the attack, dubbed 'LizaMoon,' but here's the basic gist: it looks like someone is exploiting a vulnerabilty (or vulnerabilities) in hundreds of thousands of websites running on Microsoft SQL Server 2003 and 2005. It's not yet known whether this is a vulnerability in SQL Server, or simply a case of outdated, unmaintained, and easily-exploitable CMSes.

The attack takes the form of an SQL injection, which then inserts a link to a JavaScript file hosted on the attacker's server. This is repeated over and over until every Web page in the SQL database has been infected -- and considering 3.8 million URLs have been infected, you can see that this is a very easy, and automated, attack.

Fortunately, the JavaScript isn't particularly malicious: it pops up a rogue AV program called Windows Stability Center, but that's it. Better yet, the rogue antivirus is already recognized by a bunch of real antivirus suites, including Avast, Panda and Microsoft Security Essentials.

The real problem with SQL injection attacks is that there's nothing we surfers can do about them. There will always be old and unmaintained websites, and thus SQL injections will remain one of the easiest and most lucrative tools of hackers and spammers alike. All you can do is keep your antivirus and anti-malware software up to date, and pray.

Gargantuan SQL injection infects 3.8 million URLs, installs rogue antivirus originally appeared on Download Squad on Fri, 01 Apr 2011 05:30:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments

firefox la sexta cricket

Windows 8 Explorer to feature Ribbon UI, SkyDrive and Mesh integration?

Rafael Rivera and Paul Thurrott have posted a second look at some of the early changes which have surface in Windows 8 milestone 3. First there was the restyled Welcome Screen, and now it appears that Microsoft is toying with bringing the Ribbon UI to Explorer.

The Ribbon, like in Microsoft Word and Excel, is context-aware, adding tabs for specific tasks which apply to the folder you're viewing -- such as library or picture management. You can also make out two new buttons in the status bar, which allow you to change the current folder's view style.

It's clear from all the placeholder images and repeated elements that this is very much a work in progress, but featuring the Ribbon more prominently in Windows 8 would certainly be a logical progression for Microsoft. It's slowly become more ubiquitous, moving beyond Office and into Wordpad, Paint, and several of the Windows Live Essentials applications.

There's more to the screenshots than the Ribbon UI, however. Our friend Long Zheng has noted two interesting elements in the images: Web sharing and sync (image after the break). That would likely mean users will be able to quickly upload files to SkyDrive and synchronize using Live Mesh right from Explorer in Windows 8. That's not a total surprise considering many of the earliest leaked images of Windows 8 showed Windows Live integration on the desktop.

Continue reading Windows 8 Explorer to feature Ribbon UI, SkyDrive and Mesh integration?

Windows 8 Explorer to feature Ribbon UI, SkyDrive and Mesh integration? originally appeared on Download Squad on Sun, 03 Apr 2011 08:10:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments

united budget rooney