Bluebox reveals Android security hole, may affect 99 percent of devices

Bluebox reveals Android security hole, may affect 99 percent of devices data = {blogUrl: "www.engadget.com",v: 400};when = {jquery: lab.scriptBs("jquery"),plugins: lab.scriptBs("plugins"),eng: lab.scriptBs("eng")}; var s265prop9 = ('20648952' !== '') ? 'bsd:20648952' : ''; var postID = '20648952'; var modalMNo = '93312529', modalVideoMNo = '93320648', modalGalleryMNo = '93304207'; when.eng("eng.omni.init", {pfxID:"weg",pageName:document.title,server:"acp-ld39.websys.aol.com",channel:"us.engadget", s_account: "aolwbengadget,aolsvc", short_url: "",pageType:"",linkInternalFilters:"javascript:,",prop1:"article",prop2:"software",prop9:s265prop9,prop12:document.location,prop17:"",prop18:"",prop19:"",prop20:"", prop22:"zachary-lutz", prop54:"blogsmith",mmxgo: true }); adSendTerms('1')adSetMOAT('1');adSetAdURL('/_uac/adpagem.html');lab._script("http://o.aolcdn.com/os/ads/adhesion/js/adhads-min.js").wait(function(){var floatingAd = new AdhesiveAd("348-14-15-13f",{hideOnSwipe:true});}); onBreak({980: function () { adSetType("F");htmlAdWH("93312529", "LB", "LB"); adSetType("");}}); EngadgetMenu NewsReviews Features Galleries VideosEventsPodcasts Engadget ShowTopics Buyers Guides Sagas Store Hands On More Betterer HD Mobile Alt Announcements Cameras Cellphones Desktops Displays Gaming GPS Handhelds Home Entertainment Household Internet Laptops Meta Misc Networking Peripherals Podcasts Robots Portable Audio/Video Science Software Storage Tablets Transportation Wearables Wireless Acer Amazon AMD Apple ASUS AT&T Blackberry Canon Dell Facebook Google HP HTC Intel Lenovo LG Microsoft Nikon Nintendo Nokia NVIDIA Samsung Sony Sprint T-Mobile Verizon About UsSubscribeLike Engadget@engadgettip uswhen.eng("eng.nav.init")when.eng("eng.tips.init") onBreak({980: function () {htmlAdWH("93312530", "215", "35",'AJAX','ajaxsponsor');}});Bluebox reveals Android security hole, may affect 99 percent of devices MobileByZachary LutzpostedJul 4th, 2013 at 12:08 AM 0

Researchers at Bluebox Security have revealed a disturbing flaw in Android's security model, which the group claims may affect up to 99 percent of Android devices in existence. According to Bluebox, this vulnerability has existed since Android 1.6 (Donut), which gives malicious app developers the ability to modify the code of a legitimate APK, all without breaking its cryptographic signature -- thereby allowing the installation to go unnoticed. To pull off the exploit, a rotten app developer would first need to trick an unknowing user into installing the malicious update, but hackers could theoretically gain full control of a user's phone if the "update" posed as a system file from the manufacturer.

Bluebox claims that it notified Google of the exploit in February. According to CIO, Bluebox CTO Jeff Forristal has named the Galaxy S 4 as the only device that's currently immune to the exploit -- which suggests that a security patch may already exist. Forristal further claims that Google is working on an update for its Nexus devices. In response to our inquiry, Google told us that it currently has no comment. We certainly hope that device manufacturers do the responsible thing and distribute timely security patches to resolve this issue. Absent that, you can protect yourself by installing updates through the Play Store and Android's built-in system update utility.

when.eng("eng.perm.init")

Source: Bluebox Security, CIO

Tags: android, android1.6, blueboxsecurity, exploit, galaxys4, google, mobilepostcross, samsung, security

when.eng("eng.share.init")

Previous

Boxee Cloud DVR to shut down following Samsung deal, goes dark July 10th

Next

BBC to broadcast Wimbledon final and semi-final matches in 3D Samsung Galaxy S 4

Samsung Galaxy S 4 AT&T Sprint T-Mobile 16GB Verizon 32GB Verizon 16GB 32GB 64GB LTE-A Google Play Edition Buy from $199 *

powered by gdgt

Key specs Reviews • 24 Prices Type Smartphone Operating system Android (Jelly Bean [4.2]) Screen size 5 inches Internal memory 16 GB Carriers (US) AT&T Dimensions 5.38 x 2.75 x 0.31 in Weight 4.59 oz Released 2013-04-27 see all specs ? 9average user rating Reception and call quality 9.1 Display 9.8 Battery life 8.3 Camera 9.3 Ease of use 7.9 Design and form factor 8.7 Portability (size / weight) 9.2 Media support 9.5 Durability 7.8 Ecosystem (apps, accessories, etc.) 8.9

Get better reviews from people who actually have this product!

write a reviewsee all reviews ?

Displaying prices for model:

AT&T-Black AT&T-White Sprint-Black Sprint-White $199.99 on contract Buy now $749.99 + tax & shipping Buy now Google Android 1.6

Google Android 1.6

powered by gdgt

Key specs Reviews • 3 Prices Type Mobile / embedded OS Source model Open Architecture 32-bit Released 2009-10-01 see all specs ? 7average user rating Ease of use 6.7 Speed 6 Configurability 6 Ecosystem (apps, drivers, etc.) 5.3 Openness 7.3

Get better reviews from people who actually have this product!

write a reviewsee all reviews ? when.eng("eng.livefyre.init", {articleId: 20648952,checksum: "1ddaf908f4149042a59a4b3361f88ba1",collectionMeta: "eyJ0eXAiOiJqd3QiLCJhbGciOiJIUzI1NiJ9.eyJ0aXRsZSI6IkJsdWVib3ggcmV2ZWFscyBBbmRyb2lkIHNlY3VyaXR5IGhvbGUsIG1heSBhZmZlY3QgOTkgcGVyY2VudCBvZiBkZXZpY2VzIiwidXJsIjoiaHR0cDpcL1wvd3d3LmVuZ2FkZ2V0LmNvbVwvMjAxM1wvMDdcLzA0XC9ibHVlYm94LXJldmVhbHMtYW5kcm9pZC1zZWN1cml0eS12dWxuZXJhYmlsaXR5XC8iLCJ0YWdzIjoiIiwiY2hlY2tzdW0iOiIxZGRhZjkwOGY0MTQ5MDQyYTU5YTRiMzM2MWY4OGJhMSIsImFydGljbGVJZCI6IjIwNjQ4OTUyIn0.KOMQiGaRGzaI3Dajdwxrv_k-gIcEY1LuK-7470vGw9s",domain: "engadget.fyre.co",siteId: "296092"}) onBreak({980: function () { adSetType("F");htmlAdWH("93312528", "RR", "RR"); adSetType("");}}); onBreak({980: function () {htmlAdWH("93312531", "314", "260", "text", "IMU2");}}); onBreak({980: function () { adSetType("F");htmlAdWH("93313444", "160", "600"); adSetType("");}}); when.eng("eng.rail.init") Sites We LikeTech Apple News gdgt Boing BoingSlashdotMAKEArs TechnicaTechMemePhone ScoopDesignFFFFOUND!Core77Popcorn ShowerMoCo LocoDesign*SpongeThe SartorialistNewsHuffPost PoliticsThe Daily BeastHuffington PostTech NewsBusiness NewsInvesting NewsLifestyleLifehackerHuffPost WomenStylelistAutomotive TranslogicGadlingEnvironmentalInhabitatGoodAutoblog GreenHuffpost GreenEntertainment Joystiq MassivelyThe Onioni09HuffPost CelebritySpinnerMoviefone About UsSubscribe via RSSLike Engadget on Facebook@engadget on TwitterEspañol???????????DeutschlandJoystiqRoyal Ontario Museum opens doors in Aug. for ROM game jamDragon's Crown characters get color, voice, name customizationLeft 4 Dead 2 Linux leaves the beta safe houseTuawApple marks 5 years of the App Store with new posterDouglas Engelbart, thank you for your great mindDaily Update for July 3, 2013TechCrunchApple Exploring Earbud Tech That Can Compensate For Specific Fit In Each User's EarSnapKeys Adds A Second Software Keyboard To Its Qwerty-Attacking ArsenalApple Seeks Patent For Waze-Style Crowdsourced Navigation That Could Boost iOS MapsHuffPost TechTHE HIPSTERS ARE COMINGReddit And Others Plan Huge Online Protest Against NSA For July 4Boston University Trying To Halt Sales Of iPhonesAOL Tech.

© 2013 AOL Inc.
All rights reserved. Reprints and Permissions Privacy PolicyTerms of UseTrademarksAOL A-Z HelpAdvertise with Us

lab.script("http://zor.fyre.co/wjs/v1.0/javascripts/CommentCount.js");// iOS scaling fix(function(e){var c="addEventListener",b="gesturestart",g="querySelectorAll",f=[1,1],d=g in e?e[g]("meta[name=viewport]"):[];function a(){d.content="width=device-width,minimum-scale="+f[0]+",maximum-scale="+f[1];e.removeEventListener(b,a,true)}if((d=d[d.length-1])&&c in e){a();f=[0.25,1.6];e[c](b,a,true)}}(document));// hide chrome on mobile/mobile/i.test(navigator.userAgent) && !location.hash && setTimeout(function () { if (!pageYOffset) window.scrollTo(0, 1);}, 1000);

View the original article here

Twitter Activity Will Affect Vampire Weekend's Concert Live Stream

Brian Anthony Hernandez2013-04-28 16:06:54 UTC

Indie rock band Vampire Weekend will share new music Sunday night during a concert at the Tribeca Film Festival, and fans not at the show can watch it on YouTube.

The concert live stream, directed by Boardwalk Empire star Steve Buscemi, airs tonight at 9 p.m. ET and is part of the American Express Unstaged concert series.

.@vampireweekend's concert starts at 9 p.m. ET. Watch it here ? bit.ly/15UA6xP #AmexUnstaged

— Brian A. Hernandez (@BAHjournalist) April 29, 2013

Viewers' Twitter activity during the concert will influence whether the band plays a digital encore.

Viewers' Twitter activity during the concert will influence whether the band plays a digital encore.

If enough viewers tweet reactions to the show using #AmexUnstaged, they will unlock online-only access to Vampire Weekend's post-show antics, which will include a backstage performance of "White Sky" alongside Buscemi and actor Fred Armisen's quirky character Ian Rubbish.

Leading up to the show, AmEx has released a series of funny videos showing Buscemi doing everything he can to promote the concert. AmEx exclusively gave Mashable the series' final video:

Each Unstaged concert pairs an artist with a well-known director: Kenny Chesney with Jonathan Demme, Usher with Hamish Hamilton, The Killers with Werner Herzog, Jack White with Gary Oldman, John Legend with Spike Lee and others.

Chesney did a fan challenge similar to Vampire Weekend's digital encore: The number of tweets viewers sent during his beach-side concert earned them a nine-song encore.

"We want to make sure we always have something special just for the digital audience," Susan Hammes, VP of social media marketing at American Express, told Mashable.

For Usher's Unstaged concert, people submitted digital avatars of themselves for a chance to be virtual backup dancers. For Jack White's show, fans were tasked with creating a digital mosaic by sending in photos of their faces.

The Unstaged concerts coincide with the artists’ album releases. Vampire Weekend's Modern Vampires of the City comes out May 14.

Image via Kevin Winter/Getty Images for Coachella

Topics: Entertainment, Live Stream, Marketing, Music, Steve Buscemi, Vampire Weekend, Video, YouTube if(window.pageChanged) window.omni({"channel":"entertainment","content_type":"article","top_channel":"entertainment","content_source_type":"Internal","content_source_name":"Internal","author_name":"Brian Anthony Hernandez","age":"0","pub_day":28,"pub_month":4,"pub_year":2013,"pub_date":"04/28/2013","isPostView":true,"post_lead_type":"Default"}); metaData = {"link":[["canonical","http://mashable.com/2013/04/28/vampire-weekend-concert-live-stream-steve-buscemi/"],["image_src","http://rack.1.mshcdn.com/media/ZgkyMDEzLzA0LzI5LzJhL1ZhbXBpcmVXZWVrLjlhM2NhLmpwZwpwCXRodW1iCTcyMHg3MjAjCmUJanBn/538f1e2d/c33/Vampire-Weekend.jpg"]],"meta_property":[["og:url","http://mashable.com/2013/04/28/vampire-weekend-concert-live-stream-steve-buscemi/"],["og:title","Twitter Activity Will Affect Vampire Weekend's Concert Live Stream"],["og:type","article"],["og:site_name","Mashable"],["og:image","http://rack.1.mshcdn.com/media/ZgkyMDEzLzA0LzI5LzJhL1ZhbXBpcmVXZWVrLjlhM2NhLmpwZwpwCXRodW1iCTcyMHg3MjAjCmUJanBn/538f1e2d/c33/Vampire-Weekend.jpg"],["og:article:published_time","2013-04-28T16:06:54Z"],["og:article:modified_time","2013-04-29T00:25:20Z"]],"meta_name":[["description","Indie rock band Vampire Weekend will share new music Sunday during a concert at the Tribeca Film Festival, and fans not at the show can watch it on YouTube."],["keywords",["video","youtube","music","entertainment","live-stream","uncategorized","marketing","vampire-weekend","steve-buscemi"]],["twitter:title","Twitter Activity Will Affect Vampire Weekend's Concert Live Stream"],["twitter:description","Indie rock band Vampire Weekend will share new music Sunday night during a concert at the Tribeca Film Festival, and fans not at the show can watch it on YouTube. The concert live stream, directed by ..."],["twitter:image","http://rack.0.mshcdn.com/media/ZgkyMDEzLzA0LzI5LzJhL1ZhbXBpcmVXZWVrLjlhM2NhLmpwZwpwCXRodW1iCTU2MHg3NTAKZQlqcGc/9e6ce09f/c33/Vampire-Weekend.jpg"],["twitter:site","@mashable"],["twitter:url","http://mashable.com/2013/04/28/vampire-weekend-concert-live-stream-steve-buscemi/"],["twitter:creator","@mashable"],["twitter:card","photo"],["twitter:image:width","560"],["twitter:image:height","750"]],"short_url":[["short_url","http://on.mash.to/151vpY8"]]};

View the original article here