Facebook Lifestage only works for those 21 and younger

Facebook Lifestage only works for those 21 and younger. The new iOS app, called Lifestage, is a kind of video diary where you answer biographical questions about yourself. Instead of filling in answers with text, you record a small video snippet that others can view on your profile. Every time someone updates their page, it shows up in a feed prompting others to check it out.

The app was designed by 19-year-old wunderkind Michael Sayman, a Facebook product manager who tells TechCrunch that he wanted to replicate the readymade virality of Facebook’s earliest days, when it was restricted to college students. In that sense, Lifestage’s age restriction is the updated version of needing an appropriate .edu email address, a new virtual barrier to entry. If you’re 22 or older, you’ll only be able to see your own profile and you won’t be able to communicate with any other users. 

Sayman hopes Lifestage can grow by attaching itself to local high schools, not unlike Facebook’s college-by-college approach back in 2004. The app lets you select your school, but you won’t be able to see other users unless at least 20 people from the same school start using it.

It’s unclear exactly how the app will try and prevent older users from sneaking onboard. During the sign-up process, Lifestage says it cannot confirm that users who claim to be enrolled in your high school actually are. But it restricts you to only one school and doesn't allow you to change. It also appears to have liberal blocking and reporting features, to keep parents, creeps, and other unwanted outsiders from detracting from the experience.

Read More

Niantic officially confirming that it will ban any account that appears to be cheating

Niantic is trying to make Pokemon Go more fair for its millions of players across the globe vows to ban 'Pokemon Go' cheaters.

"After reviewing many reports of in-game cheating, we have started taking action against players taking unfair advantage of and abusing Pokemon Go. Moving forward, we will continue to terminate accounts that show clear signs of cheating," Niantic said. 

The company didn't specify what the "clear signs of cheating" are, but it will most likely target accounts using Pokemon Go Bots to level up at inhuman speeds, those with skewed location data and other hacks that violate its user guidelines. Anyone who believes their account has been unfairly banned can submit an appeal right here.


source: Pokemon Go Live

Read More

Windows 10 Anniversary Update has broken some third-party USB cameras

Microsoft is facing complains from consumers and businesses about Windows 10 Anniversary Update, released on August 2nd, reportedly dropped support for two major video compression formats — specifically the H.264 and MJPEG codecs. According to Microsoft-focused blog Thurrott.com, this was supposedly a decision the company made to prevent performance issues now that certain Windows apps have more direct webcam access post-update.

Now, millions of Windows users are discovering that their webcams are freezing up, even when trying to stream via Microsoft-owned Skype. The issue is said to effect many popular webcams from big-name peripheral makers like Logitech on the hardware side, while numerous apps and services that rely on the codecs are being crippled from the software side.

Members of Microsoft’s Windows Camera team are performing damage control in support threads, and Thurrott.com reports an official fix may be in the works for a September release. Unfortunately, that may only remedy the MJPEG format. Those who rely on H.264 may be waiting even longer to make use of their webcams. If you recently installed the Windows 10 Anniversary Update, you can revert to the prior version of the software within 10 days.

Thurrott.com contributor Rafael Rivera devised a workaround that appears to be resolving the webcam freezing issues so long as you're okay with making changes to the Windows Registry:

HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Media Foundation\Platform, add DWORD "EnableFrameServerMode" and set to 0. #webcamgate

— Rafael Rivera (@WithinRafael) August 19, 2016

The hack is pretty simple; you just need to stick to the following instructions.

1. Go to the Start Menu, type "regedit" and press Enter. This opens 'The Registry Editor'.
2. Navigate to "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Foundation\Platform" in the left sidebar.
3. Right-click the "Platform" key and select New → DWORD (32-bit) Value.
4. Name this value "EnableFrameServerMode" and set the value to "0" by double clicking on it.

These are the steps if you are using a 32-bit version of Windows 10.
If you are using a 64-bit version of Windows 10, you will need to navigate to 

"HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Media Foundation\Platform"

 in the left sidebar and follow step 3 and 4 mentioned above  



source: Thurrott.com

Read More

Tesla Model S Wireless Charging - Just park to charge

Aftermarket EV charging company Evatran is almost ready to start shipping its Plugless wireless charging aftermarket solution to Tesla Model S owners who pre-ordered the product, and a new video shows the production system in action. As you can see, what the company offers is a way to create a drive-up wireless charging pad, which provides induction power via an add-on module installed on the Tesla itself.

Plugless is a true 7.2kW charger which means 20 to 25 miles of range per hour of charging. A full workday or overnight charging means Tesla owners will rarely think about range.

Plugless has a network of installers who do this part for Model S owners, included in the cost of purchase (currently $2,440 per system). The add-on won’t affect your warranty, either — even though Tesla and Plugless don’t have any official relationship, and Plugless is strictly an aftermarket add-on, so long as the Plugless system doesn’t negatively affect the vehicle there’s no effect on your warranty. Plus, the company tells me it offers its own three-year warranty that will cover the cost of any impact its system has on your car, though it hasn’t run into any issues with its add-ons for other vehicles. It’s rated for use either indoors or outdoors. The current version works with rear-wheel drive Tesla S models only, with plans to introduce support for all-wheel drive versions beginning later this year.




Evatran says the first installations are going to start rolling out in a few weeks to a small group of initial reservation holders, with more broad roll-out ramping up in the fall.

Reserve your system now: https://www.pluglesspower.com/shop/reserve-tesla-model-s/

Read More

Over 1.4 Billion Android Devices are Affected by Internet Traffic Hijacking Linux Flaw

An estimated 80 percent of Android smartphones and tablets running Android 4.4 KitKat and higher are vulnerable to a recently disclosed Linux kernel flaw that allows hackers to terminate connections, spy on unencrypted traffic or inject malware into the parties' communications.

Even the latest Android Nougat Preview is considered to be vulnerable.

The security flaw was first appeared in the implementation of the TCP protocol in all Linux systems deployed since 2012 (version 3.6 and above of the Linux OS kernel) and the Linux Foundation has already patched the Linux kernel on July 11, 2016.

However, the vulnerability (CVE-2016-5696) is now affecting a large portion of the Android ecosystem.
According to a blog post published Monday by mobile security firm Lookout, the Linux flaw is present in Android version 4.4 KitKat and all future releases, including the latest developer preview of Android Nougat. 

This means that 80% of all Android devices in use today, which is nearly 1.4 Billion devices, are vulnerable to attacks, enabling hackers to spy on your communications without even compromising your network via man-in-the-middle-attack.

However, the good news is that the Linux vulnerability is complicated and difficult to exploit, but the risk is there especially for targeted attacks.

Windows and Macs are not affected by the vulnerability.

A Google representative said company engineers are are already aware of the vulnerability and are "taking the appropriate actions. As noted in this post, the representative pointed out the flaw resides within vulnerable versions of the Linux kernel and it's not Android specific. The representative went on to say that the Android security team rates the risk "moderate," as opposed to "high" or "critical" for many of the vulnerabilities it patches. Maintainers of the Linux kernel have already patched CVE-2016-5696. It wouldn't be surprising if that fix is incorporated into a new Android release in the next month or so.

What can you do?

In order to patch this vulnerability Android devices need to have their Linux kernel updated.  Fortunately, there are a few remedies a user can do until the patch is released:

• Encrypt your communications to prevent them from being spied on. This means ensuring the websites you browse to and the apps you use are employing HTTPS with TLS. You can also use a VPN if you want to add an extra step of precaution.
• If you have a rooted Android device you can make this attack harder by using the sysctl tool and changing the value for net.ipv4.tcp_challenge_ack_limit to something very large, e.g. net.ipv4.tcp_challenge_ack_limit = 999999999
• We are not aware of PoCs exploiting this new vulnerability and anticipate Google will patch in the next Android monthly patch. In the meantime, we will continue to monitor for exploits.
• If you are more technically inclined, you can check if your device is vulnerable by running from an adb shell the following command: sysctl net.ipv4.tcp_challenge_ack_limit if the number reported is less than 1,000 (1,000 is the new number in the patch) your Android device most likely does not contain the necessary patch.

source: lookout , Arstecnica,

Read More

The NSA has been hacked

Saturday morning the news broke that a mysterious group of hackers calling themselves "The Shadow Brokers" claimed it hacked an NSA-linked group and released some NSA hacking tools with a promise to sell more private "cyber weapons" to the highest bidder.

The group dumped a bunch of private hacking tools from "Equation Group" – an elite cyber attack unit linked to the NSA – on GitHub and Tumblr.

The Shadow Brokers hacking group has published the leaked data in two parts; one includes many hacking tools designed to inject malware into various servers and another encrypted file containing the "best files" that they made available for sale for 1 Million Bitcoins.

The first archive contains close to 300MBs of firewall exploits, tools, and scripts under cryptonyms like BANANAUSURPER, BLATSTING, and BUZZDIRECTION. Most files are at least three years old, with change entries pointing to August 2013 the newest timestamp dating to October 2013. 

However, GitHub deleted the files from its page, not due to any government pressure, but because the hackers were demanding cash to release more data and the company's policy don't allow the auction or sale of stolen property on its source code management platform.

According to a technical report published Tuesday by security firm Kaspersky Lab, the leaked advanced hacking tools contains digital signatures that are identical to those in hacking software and malware previously used by the Equation Group.

Over 300 computer files found in the Shadow Brokers archive have a common implementation of RC5 and RC6 encryption algorithms – which has been used extensively by the Equation Group.
Also, the implementation of encryption algorithms is identical to the RC5 and RC6 code in the Equation Group malware.

"There are more than 300 files in the Shadow Brokers' archive which implement this specific variation of RC6 in 24 other forms," the researcher wrote. "The chances of all these being fakes or engineered is highly unlikely."

Here's the comparison of the older Equation RC6 code and the code from the new leak, which shows that they have identical functionally and share rare specific traits in their implementation: 

This code similarity makes us believe with a high degree of confidence that the tools from the ShadowBrokers leak are related to the malware from the Equation group. While the ShadowBrokers claimed the data was related to the Equation group, they did not provide any technical evidence of these claims. The highly specific crypto implementation above confirms these allegations.

Some ex-NSA insiders say the leaked hacking tools are legitimate and linked to the NSA.
One former NSA employee who worked in its special hacking division, Tailored Access Operations (TAO), told the Washington Post that "without a doubt, they're the keys to the kingdom."

"The stuff you are talking about would undermine the security of a lot of major government and corporate networks both here and abroad," said the former TAO employee, who asked Post to remain anonymous.

Moreover, another former TAO employee who also saw the leaked file said, "From what I saw, there was no doubt in my mind that it was legitimate."

So, after Kaspersky Labs analysis and former-TAO employees statements, it is clear that the leaked NSA hacking tools are legitimate.


source: Washington, Kaspersky Lab

Read More

Twitter targets extremism, suspends over 235,000 terror accounts

Over the last year, Twitter has been suspending accounts for promoting terrorism. The social network had already made it public that 125,000 accounts were suspended between mid-2015 and early 2016. Twitter  has suspended 235,000 accounts since February for promoting terrorism, the company said in a blog post today.

 "Daily suspensions are up over 80 percent since last year, with spikes in suspensions immediately following terrorist attacks," the company wrote. "Our response time for suspending reported accounts, the amount of time these accounts are on Twitter, and the number of followers they accumulate have all decreased dramatically."

The company said it's also expanded the team that works on flagging such content, and claims to have made progress on stopping accounts from starting again under a new handle. In a previous post from February, Twitter said it had suspended 125,000 accounts since mid-2015, brining their two year total to 360,000 accounts.

By Twitter’s own admission, quickly identifying accounts promoting terrorism can be a challenge, but the company reports that daily suspensions are up over 80 percent in the last year. The company also noted that suspensions tend to spike in the days immediately following major terror attacks.

Identifying behavioral patterns and implementing proprietary spam fighting tools have enabled the company to sharpen its response time, and ultimately Daesh traffic on Twitter has plummeted by 45 percent in the last two years. While algorithmic techniques account for approximately one third of account detections, the other two thirds is a product of around the clock efforts from dedicated Twitter teams.


source: Twitter Blog

Read More

Uber’s first self-driving cars will deploy picking up passengers this month

It turns out Uber has been making very rapid progress on its plan to replace its one million-plus drivers with computers. Bad news if you’re an Uber driver (Not really)…

In an interview with Bloomberg, CEO Travis Kalanick revealed that the company is preparing to add self-driving cars to its fleet of active drivers in Pittsburgh as soon as this month.

The company will deploy around 100 modified Volvo XC90s outfitted with self-driving equipment. Each vehicle will be staffed by one engineer, who can take the wheel as/when needed, and a co-pilot to observe and take notes. There will also be a “liquid-cooled” computer sitting in the trunk recording trip and map data.

That will mean that regular Uber punters in the city have a chance of getting an autonomous vehicle for their ride — their trip will be free if so.

Precious little was known of Uber’s plans for self-driving cars, but the company told Bloomberg that it will outfit cars with autonomous driving kits rather than develop its own vehicles as Google is doing.

To do that, Uber has quietly snapped up Otto, a promising startup that launched this year to bring self-driving technology to trucks. Otto’s technology can be fitted to existing trucks, and, according to Bloomberg, the technology will be adapted to create a lidar — laser detection — system to power autonomous Uber vehicles.

The Otto acquisition is hugely notable, not only for the technology but the personnel involved.

The company was founded by former Googlers Anthony Levandowski, Lior Ron, Don Burnette, and Claire Delaunay. Levandowski led Google’s self-driving car efforts, Ron was an executive on Google Maps and Motorola, while other staff have spent time with Apple, Tesla and other notable automotive firms.

The deal is set to close as soon as this month, after which Levandowski will lead Uber’s driverless car efforts. In addition, two new R&D centers will open up to speed the technology’s development.

“We were really excited about building something that could be launched early,” Levandowski told Bloomberg of why he left Google.

His additional comments — which include calling Kalanick a “brother from another mother” — hint at frustrations with the slow speed of development from Google’s self-driving project. Uber, it seems, is more willing to move forward with self-driving at a faster pace.

source: Bloomberg

Read More

World's Longest Hybrid Aircraft Takes Its First Flight

Hybrid Air Vehicles it just made history... and it might be the future of flight. It has successfully flown the Airlander 10, a long-endurance airplane/airship hybrid billed as the longest aircraft ever at 302ft end to end. It was just a short, minutes-long trip around the countryside in UK's Bedfordshire, but it showed that the massive (if more than a little posterior-like) design is airworthy.

It's going to take a while before you see production models of the vehicle, which was originally designed for US surveillance before it was scrapped. HAV only expects to make 10 per year by 2021. If it meets its goals, though, it could prove to be crucial to the aviation world. Ideally, Airlander 10 will stay aloft for about 5 days at a time -- that's ideal for communications, manned military recon and even long-distance passenger flights.

They're much quieter and produce less pollution than typical aircraft, so they could fly in areas and at altitudes where other flying machines would create too much of a disturbance.

Airlander 10 makes maiden voyage from Cardington Sheds in Bedfordshire. pic.twitter.com/Z4tN8Gnj5z

— BBC Three Counties (@BBC3CR) August 17, 2016

source: BBC

Read More

McDonald's Happy Meal activity trackers

McDonald's Happy Meals might be beloved for their included toys, but the food inside is just as unhealthy as most of the menu. As the Rio Olympics approached, the franchise hoped to reverse its kids combo's poor nutritional reputation by including an activity tracker in place of a normal toy.

Unfortunately, reports of possible skin irritations prompted the chain to end the promotion early.

Instead of handing out the pedometers until the international games ceased their four-week run, McDonald's will hand out a substitute toy while they investigate the potential dermal abrasions. The franchise gave no further details, according to The Associated Press, leaving it uncertain whether they will again attempt to urge athleticism using Happy Meal giveaways.

Source: The Associated Press

Read More

China launches the first quantum communications satellite

China's successful launch of the world’s first quantum communications satellite, the country has achieved an interesting — if somewhat difficult to explain — milestone in space and cryptography.

"The event is indeed very exciting and does carry global importance because this would be the first such experiment," said Alexander Sergienko, a professor of electrical and computer engineering at the Boston University.

Sergienko said the quantum communication race has been going on for the last 20 years since the initial demonstration of quantum key distribution link under Lake Geneva in 1995.

After that, metropolitan secure communication networks have been developed and demonstrated in Boston, Vienna, Beijing, and Tokyo, and many more examples of quantum metropolitan networks have been demonstrated in the last five years covering Canada, Italy, U.K. and Australia, he said.

Quantum Experiments at Space Scale (QUESS), nicknamed Micius after the philosopher, lifted off from Jiuquan Satellite Launch Center at 1:40 AM local time (late yesterday in the U.S.) and is currently maneuvering itself into a sun-synchronous orbit at 500 km

QUESS is an experiment in the deployment of quantum cryptography — specifically, a prototype that will test whether it’s possible to perform this delicate science from space. 

Inside QUESS is a crystal that can be stimulated into producing two photons that are “entangled” at a subatomic, quantum level. Entangled photons have certain aspects — polarization, for example — that are the same for both regardless of distance; if one changes, the other changes. The how and the why are beyond our pay grade here, so just take entanglement as a given.

The trouble is that photons are rather finicky things, and tend to be bounced, absorbed, and otherwise interfered with when traveling through fibers, air, and so on. QUESS will test whether sending them through space is easier, and whether one of a pair of entangled photons can be successfully sent to the surface while the other remains aboard the satellite.

If this is possible, the entangled photons can be manipulated in order to send information; the satellite could, for example, send binary code by inverting its photon’s polarization, one way for 1, the other way for 0. The ground station would see its photon switching back and forth and record the resulting data. This process would be excruciatingly slow, but fast enough for, say, key creation and exchange — after which data can be exchanged securely by more ordinary means.

The critical thing about this is that there is no transmission involved, or at least not one we understand and can intercept. Whatever links the two photons is intangible and undetectable — you can’t entangle a third one to listen in, and if even if you managed to interfere with the process, it would be immediately noticed by both sides of the process, which would see unexpected changes to the photons’ states.

As you can imagine, an undetectable and perfectly secure channel for digital communications is of enormous potential value for an endless list of reasons. China is early to the game with QUESS, but they’re not the only ones playing. Other quantum satellites, though none quite so advanced, are in the ether right now, and more are sure to come.
 
source: english.cas.cn

Read More

Ford and Chinese Search Giant Baidu Are Working On Their Own Self-Driving Technology

Today, Ford and Baidu have announced a joint investment of $150 million in Velodyne — a Silicon Valley firm that makes LIDAR sensors essential for guiding autonomous cars. The investment will be used to make the company's sensors cheaper to produce, hopefully lowering the cost of self-driving tech.

LIDAR essentially works like radar, bouncing a signal off nearby objects to gauge their distance. However, while radar uses radio waves for this, LIDAR uses light waves — allowing for the creation of more detailed 3D maps of the sensor's surroundings. In a press statement, Velodyne said it's expecting an "exponential increase" in the demand for its technology, and that its aim is to make its sensors as cost effective as possible. "This investment will accelerate the cost reduction and scaling of Velodyne’s industry-leading LIDAR sensors, making them widely accessible and enabling mass deployment of fully autonomous vehicles," said the company's CEO and founder David Hall.

And they will certainly be put to use. Earlier this year, Baidu announced it was building a 100-person team in Silicon Valley to develop autonomous vehicles, going head-to-head with rival Google on the US company's home turf. Ford, too, is working on self-driving tech (along with every other major automaker).

Read More

Nautilus found this incredible squid with googly eyed

While investigating the Californian coast with a remote-controlled submersible, a team of researchers from the E/V Nautilus found this incredible squid. The googly eyed fella was chanced upon during a live stream, which means we get to hear the scientists involved react professionally and calmly to their discovery.
The team spotted this Stubby Squid off the coast of California at a depth of 900 meters (2,950 feet). 

Basically, it's all about the eyes. And although they may look weird and fake,

Some select comments:

"What is it?"
"It's got weird eyes."
"It looks like they're painted on."
"It looks fake."
"It's like some little kid dropped their toy."
"He. Is. Awesome."

According to the E/V Nautilus' YouTube channel, this is in fact a Stubby Squid (Rossia pacifica), a species that looks like a cross between an octopus and a squid, but is most closely related to a cuttlefish.  Rossia pacifica is found in the Northern Pacific from Japan to Southern California up to 300m, but in addition to our sighting, researchers at the Monterey Bay Aquarium Research Institute (MBARI) have spotted them at depths of 1,300 m (4,260 ft).  "This species spends life on the seafloor, activating a sticky mucus jacket and burrowing into the sediment to camouflage, leaving their eyes poking out to spot prey like shrimp and small fish," say the description. So I guess those eyes are the last things some animals see before they die.

Read More

FORTINET: Risks - or Not - Behind Pokémon Go

At FortiGuard, we wouldn't let you down without an analysis of Pokémon Go. Is it safe to install? Can you go and hunt for Pokémon, or stay by a pokestop longing for pokeballs? While this article won't assist you in game strategy, I'll give you my first impressions analyzing the game.

Versions

There are two sorts of Pokémon applications:
1. The official versions, issued by Niantic.

We will talk more about these later, but in brief, they are not malicious.

2. The hacked versions. These are also known as "mods", which are issued by other developers, for multiple reasons. It is in this category we are the most likely to encounter malware. For instance, a repackaged version infected with DroidJack RAT has been identified to be in the wild (see analysis below).

15db22fd7d961f4d4bd96052024d353b3ff4bd135835d2644d94d74c925af3c4 

However, not all hacked versions are necessarily malicious: we inspected hacks to play on Android 4.0 (the minimum requirement is normally 4.4), or to modify GPS coordinates, neither of which showed any malicious intent.

baf0dc2e19c6ec9ebfc2853785e92e175064c522a82410c2e56e204fad156838 4d482cf9beef8d4f03a6c609025fc6025069c0c83598032e46380d23a75f1979 

Besides manual inspection, we also sent those samples to our learning-based Android prediction engine, SherlockDroid / Alligator, which confirmed our analysis ;)

Risk #1 Installing an infected version

As mentioned earlier, a sample with sha256

15db22fd7d961f4d4bd96052024d353b3ff4bd135835d2644d94d74c925af3c4

is infected with Android/SandrC.tr, dubbed DroidJack RAT.
This is a known malware, for which we have had a signature since 2015. Therefore, Fortinet customers were protected from this malicious Pokémon app from the beginning :)
This malware is quite widespread. Internal statistics at Fortinet indicate more than 8,800 detections in a year, and 160 last month alone, but those figures are largely underestimated for various reasons, including the fact that reporting is not enabled by default. So, basically, what you should remember is that this malware is still in the wild and active currently.
More malware to come?
Yes, very certainly. Malware authors are likely to continue to re-package the game with a variety of malware and distribute it. The fact the game wasn't released in all countries at the same date, for example, (thus forcing impatient users to look for alternatives on the web), combined with the fact there are large game hacking (that's nice) and cheating (that's bad ;) communities only increase the potential for downloading an infected version of the game..

Risk #2 Full Google Account Information? (This is fixed)

Adam Reeve noticed that the game requested full access to your Google account. Note: we are not talking about an Android permission here but a permission of an app connected to a Google account.
This was an error and Niantic fixed this. So be sure to remove the permission from your account and upgrade your Pokémon Go application.
Finally, note that it is not extremely clear in the documentation exactly how much "full access" really means, but no malware or exploit of this has been reported so far.

Risk #3 Unwanted network traffic

In a perfect world, we'd expect games to only send packets over the network that are absolutely necessary for the game to run, such as your location, the details of Pokémon around you, etc.
However, this is very far from reality, and for years now most Android applications are bundled with third party kits (analytics, crash reporting, cross platform engines, etc.) which use up the bandwidth which send and receive more or less useful side information containing, in the best cases, the exact model of your smartphone, or in the worst, personal information such as your phone number and other private data.
Pokémon Go is one of these bandwidth hungry applications. I downloaded it two weeks ago, and it is already close to being the most greedy application on my phone...

For mobile users, the consumption of bandwidth is a real issue. On average, 24% of an application's traffic is for third party tracking and advertising services. For some applications, the rate rockets to 98%.
While the percentage of side traffic for Pokémon Go hasn't been measured precisely, given the number of third party functionality it includes, I wouldn't be surprised if it isn’t well above 50% ;)
Here is a list of what version 0.31.0 contains:

• Crittercism - now called Apteligent - is a mobile application "performance management solution"
• Dagger is a "fast dependency injector"
• Android support libraries: those are common to nearly all Android applications
• Apache commons I/O
• Unity 3D: that's the game engine Pokémon Go heavily relies on
• Space Madness Lunar Console: this is a "lightweight Unity native iOS/Android logger"
• Google Ads
• Google GSON
• Jackson XML: this is the JSON library for Java
• JNI bridge
• Upsight: a mobile analytics and marketing platform
• Google billing
• Square Otto: an event bus
• Voxel Busters: with "cross platform native plugins"
• rx for Reactive programming

Along with such "not-so-essential" network traffic to third party servers also comes common leaks. While we expect Niantic Labs and Unity 3D (game engine) to access our geographic location (to locate Pokémon and pokestops), perhaps we shouldn’t expect apps like Crittercism, Google Ads, Jackson XML, or Upsight to retrieve our location?
The disassembled code also shows that Voxel Busters is building the full list of our phone's contacts (see figure below). They access the display name, phone number, phone and email of all contacts. The list is then compiled into a JSON object and sent to a function named UnitySendMessage, which is then exported by a Unity shared library (libunity.so) where it is dispatched to another function, and where I currently lose its track. Are contacts sent to remote servers? This is not confirmed yet, but is of some concern.

So, yes, you need to know that while you play Pokémon Go you send your geographic location, along with other details (e.g network operator name, phone brand, etc.), to several remote servers, and you "pay" for this side traffic through bandwidth consumption. Unfortunately, this is increasingly true for nearly any game found in application stores nowadays...

Risk #4 Spoofed Pokémon map or activity

The Pokémon Go application communicates with Niantic servers via HTTPS (see image below). Even better, in version 0.31.0, Niantic introduced certificate pinning to ensure that applications exchanged information with the real Pokémon servers and not with others

Initiating a TLS handshake with Pokémon Go servers

However, when certificate pinning is not active, an attacker can perform a MITM attack and thus completely modify the game for victims. For example, rastapasta managed to customize pokestops!

Hacked pokestop by rastapasta

A malicious person can easily imagine other customizations, such as displaying an infected link in a pokestop, or directly injecting infected traffic. While such attacks are probably feasible, they are tricky, and the attack would only operate on the network where the Pokémon Go MITM proxy is setup.

Conclusion

• The Pokémon Go application is not malicious.
• It is no longer possible foe the application to fully access your email. It was a risk with an older version, but hasn't ever been demonstrated.
• There are currently versions of Pokémon Go in the wild repackaged with malware, and I expect more to come. Consequently, if you are not retrieving your applications from a safe application store I recommend you check its SHA256 hash against the official one, or scan the application with an anti-virus tool.
• Like most applications nowadays, Pokémon Go (or the third party apps it uses) exposes your privacy and implies unwanted network traffic.
• Niantic has obviously paid attention to securing access to its gaming servers. However, locally, MITM proxy attacks remain possible by skilled attackers.

Keep Posted

By:  Axelle Apvrille Anti-Virus Malware Researcher, FORTINET

https://blog.fortinet.com/2016/08/11/risks-or-not-behind-pokemon-go

Alvin A. Marayan

Media Relations Director

PRC, Inc.

Unit 206 State Condominium IV 

Ortigas Ave., Greenhills San Juan M.M.

CP # 0998-9613729  * 0925-8198206

Telefax#  02-7250237 * 02-4708535

Email: alvin.marayan@teamprcinc.com.ph 

            alvin.marayanprc@gmail.com

Read More