Category: Technology

Many years ago, in the bowels of Silicon Valley, some genius realized that people enjoy getting notifications through social media – those little pings of dopamine that make you feel like you matter.

But there was a dark side. Now we get notified of pretty much anything and everything, regardless of relevance. There are new posts in this group. Someone famous has said something. This person has received your message. This person has read your message.

Wait, why haven’t they responded? It’s been five minutes. Do they not like me? oh god.

Anyway, one of the most egregious on Meta’s (née Facebook) WhatsApp messaging platform is that if you leave a group chat, everyone is informed of it.

The problem here is that most people in a group chat with others are either allegedly friends or family. When one “ghosts” their social circle – abruptly cutting off contact without warning or explanation – the fallout is delicious.

Direct messages fly between members. What have we done? Is it something we said? Are they OK? And so on.

The fact is that they have probably moved on or are fed up of your bullshit, your toddler photos, your moaning, your first-world problems. Whatever it is, you don’t need to be told that they’ve left – and they would probably prefer to go quietly too.

There are tons of people out there sitting in highly active group chats who barely contribute and end up muting the notifications. But soon they will be able to leave without stirring up drama.

Meta CEO Mark Zuckerberg took to Facebook yesterday to deliver a terse update on new privacy features coming to WhatsApp:

It’s sort of baffling that it wasn’t built like this in the first place, but – like we said – everyone loves a notification. And if they cause drama, all the better, right?

Your correspondent does not have WhatsApp installed so we asked Gen Z-er whether the touted update was newsworthy. They said: “I have loads of group chats with people in that talk all the time but I’m never active, I mute them but there are so many. So I can finally leave without looking like an asshole or getting a message from someone questioning me on why I left.

“It’s so stupid but people take offense to it.”

Now we can look forward to inevitable thinkpieces like “Group ghosting – the new WhatsApp phenomena gaining ground among Gen Z.” ®

Samsung hosted its semiannual Unpacked event on Wednesday, and as we’ve come to expect from the company, its August 2022 announcements delivered news about its latest phones, watches and earbuds: the Galaxy ZFold 4 and Z-Flip 4, Galaxy Watch 5 and Watch 5 Pro and Galaxy Buds 2 Pro. The Galaxy Z Flip 3 will get one of our favorite last-gen perks, at $100 price cut.

Among its new product announcements, Samsung brought us up to speed on its sustainability initiatives, including incorporating recycled fishing nets in its latest foldables. Plus we got to see a new promo featuring Korea’s other major global star: BTS.

All the products are expected to ship on Aug. 26.

Want a play-by-play, detailed summary? Check out our archived live blog of the event.

Now playing:
Watch this:

Galaxy Z Flip 4: Samsung’s Flip Phone Gets New Software,…

4:23

Lisa Eadicicco/CNET

Like the Z Fold 4, the Flip 4 gets the bottom-screen trackpad feature in its Flex Mode and the nighttime photography improvements that were launched with the S22, including night portrait-mode photos. You’ll also be able to send quick replies to texts, make calls and shoot portrait-mode photos from the cover screen.

You’ll also be able to get a Bespoke Edition like the Flip 3.

Refreshed components include:

• A brighter wide lens and larger pixels in the 12-megapixel cameras
• Snapdragon 8 Plus Gen 1 processor
• Battery boost to 3,700mAh

Readmore:

Now playing:
Watch this:

Samsung Galaxy Z Fold 4 First Take: Bigger Cover Screen,…

5:43

Lisa Eadicicco/CNET

The Galaxy Z Fold 4 has a wider cover screen that makes apps look more like they’re intended and that’s designed to make it look like a typical phone when it’s closed. A new Flex Mode feature, also coming to the Flip 4 lets you use the bottom half of the screen as a trackpad.

Samsung claims it’s more durable than its predecessor, notably the internal tablet-sized display. We were treated to a discourse on the upgraded hinge, the new screen-layer architecture and shock-absorbing sponge. The company also Samsung also says the inner screen is brighter, and will have a less noticeable under-screen camera. It inherits the nighttime photography improvements launched with the S22 line, including night portrait-mode photos.

Samsung says this is the first device with Android 12L, the version of Android optimized for tablets. 12L brings a new task bar for streamlining app switching.

Refreshed components include:

• 50-megapixel main camera and a telephoto lens with 3x optical zoom in addition to the existing 12-megapixel wide-angle lens
• Snapdragon 8 Plus Gen 1 processor

Readmore:

Lisa Eadicicco/CNET

In addition to the existing Watch sizes, there’s a new, larger and heavier Pro model with a more durable titanium build. Samsung says both Watches have longer battery life over earlier models thanks to higher-capacity batteries (590 mAh in the Pro), an infrared skin temperature sensor and a more durable sapphire crystal for the watch face instead of Gorilla Glass. Plus, there will be new faces available.

There’s a larger surface area for sensor contact on your wrist, which Samsung says will provide more accurate results, and a smaller combined sensor size.

Samsung’s offering some trade-in discounts on preorders: $75 off the Watch 5, or $125 off the Pro if an “eligible” watch is traded in, along with a $50 credit for accessories.

Readmore: Samsung’s Galaxy Watch 5 Now Includes a Pro Model and Better Battery Life

Richard Peterson/CNET

The Galaxy Buds 2 Pro have beefed up surround and hi-fi audio — as long as they’re connected to a Galaxy phone running Samsung’s One UI 4.0 or later. Samsung’s also eked out another two hours from its battery.

Later in the year, Samsung will be updating the Buds 2 Pro with better 360 LE audio.

Readmore:

Patrick Wardle is known for being a Mac malware specialist — but his work has traveled farther than he realized.

A former employee of the NSA and NASA, he is also the founder of the Objective-See Foundation: a nonprofit that creates open-source security tools for macOS. The latter role means that a lot of Wardle’s software code is now freely available to download and decompile — and some of this code has apparently caught the eye of technology companies that are using it without his permission from him.

Wardle will lay out his case in a presentation on Thursday at the Black Hat cybersecurity conference with Tom McGuire, a cybersecurity researcher at Johns Hopkins University. The researchers found that code written by Wardle and released as open source has made its way into a number of commercial products over the years — all without the users crediting him or licensing and paying for the work.

The problem, Wardle says, is that it’s difficult to prove that the code was stolen rather than implemented in a similar way by coincidence. Fortunately, because of Wardle’s skill in reverse-engineering software, he was able to make more progress than most.

“I was only able to figure [the code theft] out because I both write tools and reverse engineer software, which is not super common,” Wardle told TheVerge in a call before the talk. “Because I straddle both of these disciplines I could find it happening to my tools, but other indie developers might not be able to, which is the concern.”

The thefts are a reminder of the precarious status of open-source code, which undergirds enormous portions of the internet. Open-source developers typically make their work available under specific licensing conditions — but since the code is often already public, there are few protections against unscrupulous developers who decide to take advantage. In one recent example, the Donald Trump-backed Social Truth app allegedly lifted significant portions of code from the open-source Mastodon project, resulting in a formal complaint from Mastodon’s founder.

One of the central examples in Wardle’s case is a software tool called OverSight, which Wardle released in 2016. Oversight was developed as a way to monitor whether any macOS applications were surreptitiously accessing the microphone or webcam, with much success: it was effective not only as a way to find Mac malware that was surveilling users but also to uncover the fact that a legitimate application like Shazam was always listening in the background.

Wardle — whose cousin Josh Wardle created the popular Wordle game — says he built OverSight because there wasn’t a simple way for a Mac user to confirm which applications were activating the recording hardware at a given time, especially if the applications were designed to run in secret. To solve this challenge, his software used a combination of analysis techniques that turned out to be unusual and, thus, unique.

But years after Oversight was released, he was surprised to find a number of commercial applications incorporating similar application logic in their own products — even down to replicating the same bugs that Wardle’s code had.

Image: Patrick Wardle

Three different companies were found to be incorporating techniques lifted from Wardle’s work in their own commercially sold software. None of the offending companies are named in the Black Hat talk, as Wardle says that he believes the code theft was likely the work of an individual employee, rather than a top-down strategy.

The companies also reacted positively when confronted about it, Wardle says: all three vendors he approached reportedly acknowledged that his code had been used in their products without authorization, and all eventually paid him directly or donated money to the Objective-See Foundation.

Code theft is an unfortunate reality, but by bringing attention to it, Wardle hopes to help both developers and companies protect their interests. For software developers, he advises that anyone writing code (whether open or closed source) should assume it will be stolen and learn how to apply techniques that can help uncover instances where this has happened.

For corporations, he suggests that they better educate employees on the legal frameworks surrounding reverse engineering another product for commercial gain. And ultimately, I hope they’ll just stop stealing.

The new services aim to enhance security

The popular messaging service WhatsApp has introduced three new features that aim to enhance privacy and security for users.

“Your privacy deserves more protection,” said the Meta-owned platform in a post shared on social media.

Mark Zuckerberg, Meta CEO, shared the announcement on his Facebook page as well.

“New privacy features coming to WhatsApp: exit group chats without notifying everyone, control who can see when you’re online, and prevent screenshots on view once messages. We’ll keep building new ways to protect your messages and keep them as private and secure as face-to-face conversations,” the post said.

Here is a dive into what each of the new features mean:

1. Exit group chats without notifying anyone

WhatsApp users are no strangers to group chats. The platform is widely used for group texting. With this new feature, WhatsApp aims to give people a quiet way to exit groups, without drawing the attention of other group members.

Previously when a member of a WhatsApp group exits the chat, all members are notified. After the privacy update, only the group admin will be notified of the departure, while the rest of the members remain unaware.

2. Control who can see you when you’re online

WhatsApp users will be able to pick the contacts that can see them online. If a user does not want a few (or most) of their contacts to know that they are currently using a platform, they can block them from seeing the ‘online’ indicator that appears on the chat.

3. Prevent screenshots on ‘view-once’ messages

View-once messages are texts you can send on WhatsApp that get deleted after they are viewed by the receiver.

With this privacy update, receivers will not be able to take screenshots of videos or photos sent using the view-once feature. Whatsapp says that this new development will be available to users soon.

Earlier this week, WhatsApp announced that users can now delete messages up to 2 days after they are sent – an upgrade from the previous limit. Before the update, users could delete messages for everyone in the chat up to 24 hours after they had been sent. After that, they could only delete messages for themselves but they would still be visible to everyone else in the chat.

ALSO READ:

How is a physical access attack conducted? You’d see one happen — right?

“An attacker could walk into an organization, plug a flash drive with an advanced strain of ransomware into a computer and then walk around pretending to be a phone repairman or someone working with pest control,” said Bryson Payne, author of Go H*ck Yourself.

Such attacks are not always as easy to detect as one might think — nor as easy to defend against. Organizations need to converge cybersecurity and physical security to fully protect their assets. But, before trying to improve the relationship between the two, it’s important to understand how weak physical security affects cybersecurity and puts an organization’s sensitive data at risk.

Physical security, as the name suggests, is the protection of networks, systems or data from physical actions or events. The threat of physical cybersecurity attacks has increased with remote and hybrid work models that have employees working outside the office and on noncompany-sanctioned devices and networks.

“An employee could be working on their laptop in a coffee shop, and a threat actor could be listening for unencrypted traffic on the free Wi-Fi,” said Payne, a professor and founding director of the Center for Cyber ​​Operations Education (now the Institute for Cyber ​​Operations) at the University of North Georgia. “The employee could get up to order another coffee, and the hacker could sit down at the employee’s computer and, in five seconds, gain access to saved passwords on the device’s browser.”

To better help readers understand the dangers of physical cybersecurity attacks, Payne teaches readers how to hack their own devices in his book. These ethical hacker techniques give readers greater insight into cybersecurity and enable them to better protect themselves from threat actors.

In this excerpt from Chapter 2, “Physical Access Hacks,” Payne explains how to conduct a Sticky Keys hack. This walkthrough demonstrates a hack that involves both cybersecurity and physical security vulnerabilities.

Physical access hacks may sound scary because they can be used maliciously by attackers on stolen or unattended computers. However, they also have constructive applications. Ethical hackers at home and at IT help desks use techniques like the Sticky Keys hack or the Mac root hack to recover files that would otherwise be lost due to a forgotten password. If you have an old computer in the garage or attic with family photos or other important documents that you can’t access because no one remembers the computer’s password, these hacks can help.

Warning: do not perform either of these hacks on your main computer, because they could leave your machine vulnerable to attack. You can usually find an old desktop or laptop if you ask around. Get creative, but stay ethical; be sure to get the owner’s permission before trying out these hacks on someone else’s computer. If you can’t find an extra Windows or Mac computer to practice on, you can still read this chapter to understand the dangers of physical access attacks.

The Sticky Keys Hack

Sticky Keys is a Windows feature that makes it easier to issue certain keyboard commands, like CTRL-C to copy or CTRL-V to paste, by allowing you to press the keys one after another instead of all at once. Sticky Keys is triggered by pressing SHIFT five times and can even be turned on from the Windows login screen, before a username or password has been entered.

For this hack, we’ll replace the Sticky Keys program file with another file, cmd.exe. That way, instead of launching the usual Sticky Keys assistant, pressing SHIFT five times will launch a command prompt. This is a text-based program that lets us enter commands directly into Windows. By launching a command prompt at the login screen (see Figure 2-1), you’ll be able to add a new username and password, give yourself administrator-level access to the computer, and access the computer’s files, all without knowing the login information on that computer!

Since Windows 10 computers that have been updated in 2019 or later are safe from the Sticky Keys hack, you’ll need an older Windows computer to try out the hack for yourself. You’ll also need a Windows 10 installation disc or USB drive. To create one, follow the instructions in Appendix A.

Booting from a Windows 10 Installation Disc

To replace the Sticky Keys program with the command prompt program, we need to access the hard drive that contains those program files using a Windows 10 installation disc or USB drive. Once you’ve created an installation disc, as described in Appendix A, insert the disc and then restart the computer.

We need to tell the computer to load the operating system (OS) from the disk or USB drive instead of from the computer’s hard drive. To do this, we’ll access either the boot menu or the Basic Input/Output System (BIOS), which contains basic settings that control your computer when it starts up. Different PC manufacturers and different versions of Windows cause the instructions to vary a bit, but the following steps combined with a little web searching will get you into most older Windows computers:

1. On Windows computers, you press a special key to access the boot menu or BIOS. If your startup screen doesn’t show you which key to press just before the Windows startup logo appears, reboot your computer and quickly press ESC, DELETE, F8, F9, F10, F11, or F12 right as it begins to start up. Search online for “boot menu” and the specific make and model of your computer to find the right key.
2. If the boot menu appears, select the Boot from DVD or Boot from USB option to boot from the Windows installation disc you inserted, then move on to step 5.
3. If the boot menu doesn’t appear after a few restarts, try entering the BIOS menu instead: turn the computer off and on again, and press DELETE, F2, F9, F10, F12, or ESC. Search online for “BIOS” and your computer model to find the right key.
4. Once you’re inside the BIOS, find the boot options and change the order or priority of your boot devices (often by using your arrow keys) to make the USB or DVD the top option. Then save the changes and exit the BIOS.
5. Reboot the computer again. You should briefly see the message Press any key to boot from CD or DVD or Press any key to boot from USB device. Press any key (such as the spacebar) immediately to boot from your DVD or USB.
6. When the Windows installation disc starts up, click Next>Repair your computer>Troubleshoot>Command Prompt, as shown in Figure 2-2. The menu order or the option names might look different, but look for the Windows command prompt.

Warning: make sure you don’t install Windows 10 — that would wipe out all the files from the PC you’re trying to recover!

7. Once you’ve reached the Windows command prompt (usually a black, text-based window), type c: and press ENTER to change to the C: drive, as shown here:

   X:> c:

8. Enter the command say to see a list of files and folders on the C: drive. Look for a folder called Windows (it will be marked , short for directory).

   C:> dir
     Volume in drive C is Windows 10
     Volume Serial Number is B4EF-FAC7
     Directory of C:
   --snip--
   03/15/2018 02:51 AM   <DIR>     Users
   05/19/2019 10:09 AM   <DIR>     Windows *1
   --snip--

   This folder (*1) contains the operating system files, including the command prompt application and the Sticky Keys program file that we need to swap out to perform this hack.

9. If there’s no Windows directory on the C: drive, try the same process in the D: drive by entering D: and then say. If the D: drive doesn’t have the Windows directory either, keep going through the alphabet (E:, F:, G:, and so on) until you find a drive containing Windows in its listing.

Gaining Administrator-Level Access

Now to replace the sethc.exe Sticky Keys program with the cmd.exe command prompt program. Then we’ll be able to create a new administrator account on the computer.

1. Enter the following three commands:

   C:> cd WindowsSystem32
   C:WindowsSystem32>  copy  sethc.exe  sethc.bak
   C:WindowsSystem32>  copy  cmd.exe  sethc.exe

   These commands enter the directory where we can find both sethc.exe and cmd.exe, create a backup copy of the Sticky Keys program, and replace the original Sticky Keys program file with a copy of the command prompt program file. This way, whenever the computer runs sethc.exeit will open a command prompt window in place of the Sticky Keys program.

2. After the third command, Windows will ask you if you want to overwrite exe. Enter Y to proceed.
3. Remove the Windows 10 installation DVD or USB and reboot the computer.
4. When the PC boots to the login screen, press SHIFT five times. Instead of the usual Sticky Keys program, you should see a command prompt window pop up in front of the login screen, as shown in Figure 2-3.
5. Enter the following two commands into the command prompt window:

   C:WindowsSystem32> net user ironman Jarvis /add
   C:WindowsSystem32> net localgroup  administrators ironman /add

   The first command adds a user account named Hombre de Hierro with the password Jarvis to the Windows computer. The second command adds the Hombre de Hierro user to the list of local administrators. This means that when we log in as Hombre de Hierrowe’ll have administrator-level access to all the files on the computer.

Figure 2-4: We’ve successfully added a user named ironman as an administrator on this computer.

6. When you see a success message like the one in Figure 2-4, close the command prompt.

In addition to creating a new user account, you can also reset the password of an existing user from the command prompt window by entering net user followed by the existing username and the new password you want to set — for example, net user bryson Thisisyournewpassword!. However, you should never reset another person’s password without their permission and the permission of the computer’s owner.

Now You’re an Administrator. Log In!

Congratulations! You now have access to the machine as an administrator. Go ahead and log in. Enter .Hombre de Hierro as the username (or select Hombre de Hierro from the list of accounts, as shown in Figure 2-5). The dot and backslash before ironman tell Windows the account is local to the computer and not stored on a network server. After entering the username, enter the password, Jarvis.

Since we made the Hombre de Hierro user a member of the local administrators group, you should have administrator-level access to there files and folders, including all users and documents in C:Usersas shown in Figure 2-6.

When you click into another user’s folder for the first time, you’ll see a pop-up message saying you need permission to open another user’s files, as shown in Figure 2-7. Since you’re an administrator, click Continue to grant yourself permanent access!

The Sticky Keys hack works only on Windows machines. However, computers running macOS are vulnerable to physical access hacks as well.

Bryson Payne

About the author
Bryson Payne is an award-winning cyber coach, author, TEDx speaker and founding director of the Center for Cyber ​​Operations Education (now the Institute for Cyber ​​Operations) at the University of North Georgia (UNG.) He is a tenured professor of computer science at UNG, where he has taught aspiring coders and cyber professionals. In 2017, I have received the University System of Georgia Chancellor’s Service Excellence Leader of the Year Award. He has also been awarded the Department of the Army Commander’s Award for Public Service medal from US Army Cadet Command and the Order of Thor medal from the Military Cyber ​​Professionals Association. Payne holds a Ph.D. in computer science from Georgia State University. He is also the author of Teach Your Kids to Code and Learn Java the Easy Waypublished by No Starch Press.