On Android, Stagefright can be Very Bad 
Joshua Drake (@jduck) from Zimperium zLabs has uncovered the mother of all Android vulnerabilities affecting an estimated 95%, or 950 million, of all Android devices. The heart of the problem lies within Stagefright, a media library for playing back various formats.
Attackers only need your mobile number, using which they can remotely execute code via a specially crafted media file delivered via MMS. A fully weaponized successful attack could even delete the message before you see it. You will only see the notification. These vulnerabilities are extremely dangerous because they do not require that the victim take any action to be exploited. Unlike spear-phishing, where the victim needs to open a PDF file or a link sent by the attacker, this vulnerability can be triggered while you sleep. Before you wake up, the attacker will remove any signs of the device being compromised and you will continue your day as usual – with a trojaned phone.
The good news:
Considering severity of the problem, Google acted promptly and applied the patches to internal code branches within 48 hours…
The not so good news:
For the mobile devices without zIPS protection, fixes for these issues require an OTA firmware update for all affected devices. Such updates for Android devices have traditionally taken a long time to reach users. Devices older than 18 months are unlikely to receive an update at all.
If you’re an Android user, now might be a good time to look at updating your firmware.
Wednesday, 15 Jul 2015
The Really Big One
Kathryn Schulz has written an interesting article in The New Yorker on the Cascadia subduction zone on the US west coast. Unlike the San Andreas fault, this fault line is far more dangerous and has been lying dormant for longer than expected:
…we now know that the Pacific Northwest has experienced forty-one subduction-zone earthquakes in the past ten thousand years. If you divide ten thousand by forty-one, you get two hundred and forty-three, which is Cascadia’s recurrence interval: the average amount of time that elapses between earthquakes. That timespan is dangerous both because it is too long—long enough for us to unwittingly build an entire civilization on top of our continent’s worst fault line—and because it is not long enough. Counting from the earthquake of 1700, we are now three hundred and fifteen years into a two-hundred-and-forty-three-year cycle.
The scenario of what might happen if and when the fault line produces an earthquake is sobering.
Together, the sloshing, sliding, and shaking will trigger fires, flooding, pipe failures, dam breaches, and hazardous-material spills. Any one of these second-order disasters could swamp the original earthquake in terms of cost, damage, or casualties—and one of them definitely will. Four to six minutes after the dogs start barking, the shaking will subside. For another few minutes, the region, upended, will continue to fall apart on its own. Then the wave will arrive, and the real destruction will begin.
When I read articles like this I often wonder what the experts in the field think and whether they agree with everything said:
New Yorker story on Cascadia EQ in PacNW is accurate representation of EQ & tsunami threat, if a bit sensationalist. http://t.co/alCn5TVyv5
— Dr. Lucy Jones (@DrLucyJones) July 14, 2015
Dr. Lucy Jones is a USGS Seismologist, if she says its an accurate description then residents on the US west coast might have something to worry about…
Monday, 13 Jul 2015
The Death of Reddit
Chuq Von Rospach has written a blog post in which he gives a good analogy for why he’s not a Reddit member and why he feels it will ultimately fail.
The thing I’ve always told people interested in community management is this: if you’re running a sports bar, and you have a gang of bikers move in, you have two choices. You can either eject the bikers, or you’re running a biker bar.
I’ve never understood how some online communities seem to bring out the best in people and others the worst.
