How to Detect SSL flaws in Mobile Apps

 

The Secure Sockets Layer protocol (SSL) is a foundational technology on the modern Internet, enabling data in transit to be encrypted and travel securely. Yet according to security researchers Tony Trummer and Tushar Dalvi, many popular mobile apps do not properly implement SSL.

Trummer and Tushar, both security researchers working at LinkedIn, detailed their finding in a session at the Defcon security conference over the weekend. The research was not sponsored or endorsed by their employer and was done on their own time.

In many of the mobile apps they tested across both iOS and Android, the two researchers found that app developers had disabled certificate authority (CA) validation. This validation is a best practice to ensure that an SSL certificate is authentic and valid.

Checking for CAs

Trummer and Tushar suggested a simple test that can be used to see if a CA is being contacted. They recommend that researchers install BurpSuite software, a Web application security testing toolkit that has both free and paid editions. Burpsuite can be used as a proxy for Web traffic and can generate a CA signed per-host certificate.

The end-user device with the mobile app should be configured to point to the proxy. If secure SSL traffic from the device is still able to get through, that is an indication that CA validation is not properly working.

Checking for Host names

With SSL it’s also important that the name on the certificate matches the name of the site being contacted. To test that proper hostname checking is in place, get a valid certificate for a domain different than the target domain being tested.

Trummer and Tushar suggest that BurpSuite then be configured to use the test certificate. If secure SSL traffic is still able to flow through from the mobile app, then there is a potential problem.

Trummer noted that there are also apps that send sensitive information like credit card data without any SSL or encryption at all. Mobile app developers need to be trained on proper SSL security implementation, he said. He added that vendors should have policies in place to make sure data in transit is secured.

Trummer suggested that Android developers be especially careful with TrustManager, SSLSocket and HostName Verifier attributes in mobile application code.

For iOS developers, the areas that need to be emphasized and scrutinized are the _AFNETWORKING_ALLOW_INVALID_SSL_CERTIFICATES_, SetAllowsAnyHTTPSCertificate and kCFStreamSSLAllowsAnyRoot functions in mobile app code.

Intel’s Basis Introduces The Peak: Fitness Track

Wearable technology is no more a geeky things, it has become the new fashion variable. Apart from being cool it is a multi- functional purpose gadget substitute. We have recently witnessed an increased rise in the developmental rate of wearable technology with some of the most renowned companies coming forward with their products in line. With latest release of iWatch by the mighty Apple Inc. the remaining companies have taken it quite personally to launch a product that might be counted as a worthy rival. Basis has taken off the curtain from its latest product, The Peak, a watch type fitness tracker.

Intel owned fitness band maker Basis is shifting into higher gear with a new device called Peak — which it says improves on its built-in heart rate monitoring and, coming soon, will add basic smart watch functionality. It’s a device focused on tracking your health, fitness, and sleep, but with this time the company has spent some time on their watch’s looks, packing its motion and heart rate sensors into a thinner body made of aluminum and glass. The Basis Peak arrives in November for $199. It’s a big update for Basis, which was acquired by Intel in March for an undisclosed price rumored to be in the $100-$150 million range. Intel did pick up Basis earlier this year, as Intel used this opportunity to take a peek into the world of wearable devices. After all, it makes perfect sense, and imagine the kind of collaboration that Intel would end up with if they could come up with a chip worthy of a place in small and connected devices. What makes the Peak really interesting though isn’t what you see, but what you don’t see. For starters, it has a faster processor than the B1 Band, which most notably is able to improve the built-in heart rate monitor. According to Re/code, Basis claims that Peak should be accurate enough to replace a heart-rate chest strap.

In addition to all of the health-related information you’d expect to see on a watch like this, Peak will eventually support a variety of notifications which it will leech from your smartphone via Bluetooth LE. Further, Basis’ app, when used with this watch, will be smart enough to understand what its wearer will be capable of on any given day, and can reorder workout activities accordingly. Clearly, this really is one “smart” device. Beyond that, the Peak’s motion sensor is better able to track what kind of exercise you’re up to (and thus give you a better idea of how many calories you’re burning) and how much you roll around in bed while it’s tracking your sleep. And you can actually wear the device through the night without waking up with a low battery warning. As with the B1, you can expect about 4 days of battery life from the Peak, as it uses a low power, high-contrast LCD display that sips power compared to the screens on Android Wear devices. It’ll be interesting to see how it sells over the holiday season: some expect Android Wear sales to pause as consumers wait to see what the Apple Watch is like. As a health-focused device, the Peak might be able to avoid that negative effect by appealing to users who care about fitness and sports over notifications and wrist-based apps.

SoundTouch II By Bose

Music enriches the soul soothes the mind. All the latest smart devices have an option of playing sound tracks. Smartphones, teblets, even car systems. Many companies have launched various top notch products related to this field. Almost every month new stereo system models are being released incorporating many new features like Wi-Fi connectivity and karaoke. New design are expected in the market that are not only compact but also do not compromise on the quality of output. It should look smart and futuristic at the same time. After the release of Om’s Bluetooth Levitating Speaker, next in line we have Bose’s second generation multi-room wireless speakers, dubbed SoundTouch Series II.

The demand for the portable speaker around the house is increasing and to meet it Bose has launched SoundTouch II, which is kicking off with three new speakers before expanding to a number of other Bose products. The new speakers come in three different sizes: the SoundTouch 30 is the biggest speaker, with a built-in woofer and meant for large rooms; the SoundTouch 20 slightly smaller, for a bedroom or kitchen. The flagship SoundTouch 30 Series II is priced $700, followed by the midsize SoundTouch 20 Series II priced $400 and wrapping with the SoundTouch Portable Series II priced $400. While the two larger models are designed to take residence in a specific room and serve it up with wireless audio, the Portable model includes a built-in rechargeable battery so it can be hauled around anywhere it is needed. Bose also added a black color option to its existing white finish for this year. The SoundTouch wireless audio system is what links all these speakers together, allowing them to connect to your home Wi-Fi network for universal control of music through your entire house.

Digital Trends reviewed the original SoundTouch 20 at the beginning of the year, and while we found it performed well in the sound quality department, its shortcomings were in the list of apps it supported, and a slightly clunky interface for the app that operated the system. Bose claims its new systems are easier to use than before, and designed to offer listeners an unprecedentedly simple experience — a trait Bose has built its reputation on.  Bose sets itself apart from the competition with the deep integration of car audio-like presets. Each of the three SoundTouch speakers have buttons numbered one through six, which will instantly play whatever audio they’ve been assigned. Buttons can be set to a specific internet radio station, an album or artist from your home network, or even a single song. Once set, the presets are universal across all the speakers on the network, allowing anyone to immediately play their favorite music in any room with the single press of a button. The new SoundTouch Series II speakers are available now at Bose retail stores, Bose.com and authorized Bose dealers. The new music services and enhanced app functionality are also available via free software upgrades for all existing SoundTouch devices. We put all your music in one place. Now we can control it in the easiest way available, and personalize it for what we love and how we live.

Polaroid PoGo- An Instant Mobile Printer

Great strides have been made by Digital Camera companies for the betterment of digital technology. One of the major distinction between the Polaroid Experience, then and now is that it’s not about the camera, it’s about the printer. There is an evident change observed in digital technologies. Much sooner than anyone was pondering computerized cameras, Polaroid created moment photography. Polaroid is not leaving the moment photograph, advertise however as the dispatch of the Polaroid Pogo brings the idea of moment photographs to the 21st century by utilizing the most recent Zink (Zero Ink) printing technology to help current advanced cameras. The Polaroid Pogo is a little battery worked versatile printer that permits you to print your computerized photographs on the go. With Bluetooth and Pict-Bridge backing it’s conceivable to print photographs from essentially all advanced computerized cameras and cellphones. The Polaroid Pogo arrives in a perfect and minimized bundle weighing only 230 grams and measuring 120mm x 72mm x 23.5mm. On the “top” of the unit you’ll discover a solitary connector for connecting to the force supply to charge the inner battery. As an afterthought from the force connector is the force catch, and several tri-shade status LED’s which let you know the print and battery power status. Polaroid has included the missing piece, so you can print from Pictbridge cameras, and from cellphones and different gadgets that can print through Bluetooth.

Shoot a picture, and after 60 seconds, you had a snapshot in your hand. It’s the model Polaroid experience. The Polaroid Pogo Instant Mobile Printer to a great extent reproduces that encounter for the advanced photographic age. By that is the USB 2.0 connector which permits you to associate a good computerized camera. On the end of the unit there’s a solitary space where the printed paper is gradually launched out. The paper is stacked in a tray got to by pressing a discharge catch toward one side. Zink paper come in packs of 10 yet there is by all accounts room in the paper tray for around 30 sheets. Setting up is dead straightforward. When you expel everything from the case, you simply need to introduce and charge the interior rechargeable battery. On the off chance that you are a bit fretful you can begin printing while the unit is charging. Anyone who has ever utilized a Polaroid Instant camera will know that it was so advantageous to have a picture instantly in the wake of taking it to show to your companions or as a record of an occasion. While it’s still simple to take moment photographs in a social setting, normally with a camera telephone, a paper duplicate is harder, incidentally, since the downfall of Polaroid’s moment film cans. While a printer like this is outlined basically for its fun on-interest component, the photographs are presumably best seen in pubs and clubs where the lights are low. The prints demonstrate an irritating absence of the subtle element, give confronts a by and large smeared look and incorporate the incidental white line where it shows up the print head has failed.

The prints have sticky backs. Peel off the support paper and you can stick them on dividers, furniture or your companions’ backs. Everything you need to purchase to run the Pogo is paper, and 30 sheets cost around £7 (8.85 USD). Every 30-sheet pack contains three sachets of 10 sheets, as the printer can just take this a lot of people, and a little blue under-sheet with a standardized identification printed on it illuminates the printer you’ve stacked new paper. An expense of 23.15p for every 3 x 2 inch print isn’t modest, however Polaroid has constantly charged additional for the accommodation of its moment photograph innovations. The safe wager is that the truth will fall some place between the two extremes. Anyway, regardless, the Polaroid Pogo Instant Mobile Printer conveys what it guarantees the option to print a picture whenever and wherever effortlessly.

Plexidrone: Latest Tool For Smart Ariel Photography

 

Definitely the next trend in technology are the drones. The recent years have witnessed a steady rise in the production of various drones to simplify automated machines as we know it. Many major projects have hit the market like IRIS+, project wings, etc. Once thoroughly questioned about reliability, now these drones are accepted widespread for the services they are able to provide remotely. These automated machines not only provide efficient controls over the designated tasks but also have a little tiny room to take standalone decision based on its artificial intelligence. The team behind the PlexiDrone really couldn’t have timed its run any better, looking to shake things up with a snap-together drone capable of lugging a range of camera equipment along for the ride.

The Plexidrone launched on Indiegogo at the beginning of October and successfully cruised past its initial funding goal of $100k within the first week of its campaign. Like all successfully crowdfunded drone campaigners, the DreamQii team have been quite creative marketing the virtues of their creation and proactive in generating press for their campaign. Plexidrone is an entombment of many features. It has ultrasonic sensors for obstacle avoidance and safety. It is also assembled with snap together assembly, with no tools. It can be assembled in merely less than 45 seconds. That is miraculously fast. In addition to this, it has retractable landing gear, so you will never see them in the corners of your shots, providing you with a clear cut view. With DreamQii’s PlexiDrone, you will never have to crop landing gear or propellers out of your footage. A perfectly-positioned camera stabilization system combined with cutting-edge retractable landing gear give PlexiDrone a completely unobstructed 360-degree field of view. It has swarming technology, to control multiple drones simultaneously by smartphone or a tablet, taking multi- tasking to a whole new level. And after all it also has an aerodynamic backpack to carry aerial all your gear.

Attentive to market feedback from film-makers and photographers, DreamQii realized the demand for an extremely portable aerial photography platform. In response, DreamQii engineered an ultra-compact solution that can be assembled or disassembled in less than a minute, with no tools. DreamQii’s PlexiDrone is also a development platform where makers can create and share custom payload modules. Easy access to a developer’s port and power port make the PlexiDrone an ideal development platform.  The PlexiHub is a proprietary Bluetooth-enabled bridge that acts like a wireless router for drones. This allows one user to simultaneously capture aerial footage from multiple vantage points. Swarm technology extends usage scenarios by allowing a single user to control a network of drones to accomplish goals like following search grid patterns or surveying larger surface areas. PlexiDrone is controlled through any smartphone or tablet using DreamQii’s custom PlexiGCS (ground control software). PlexiGCS is a next-generation control platform that allows the user to operate one or many PlexiDrones with a range of up to one mile. Users interact with a 3D map to identify stationary or moving points of interest, draw desired flight paths and send commands. PlexiGCS eliminates the need for expert piloting skills and a bulky RC remote control. There are only a limited number of PlexiDrone packages selling for the low early-bird price.

iOS 8

iOS 8 is the eighth major release of the iOS mobile operating systemdesigned by Apple Inc. as the successor to iOS 7. It was announced at the company's Worldwide Developers Conference (WWDC) 2014 on June 2, 2014, and was released on September 17, 2014. A new app namedHealth and a corresponding framework named HealthKit became available with the release. Upon the release, Siri was updated to support hands-free activation and music identification using Shazam. Voice and video messages are automatically deleted unless the user saves them for future reference. Interactive notifications let the user respond to texts without leaving the app they are currently using. Five days after release, iOS 8 had been installed on 46% of compatible Apple devices.

New features

Photos and Camera

The Photos app contains more options to edit photos. The cropping feature now enables rotating images both clockwise and counter-clockwise. Furthermore, users can set the desired brightness and colors for photos. The Camera app now features a shot timer, which can be set to 3 or 10 seconds.

Notification Center

Notification Center is much improved in comparison to iOS 7 and 7.1. Users can now add and remove widgets in Notification Center with the "Edit" button. This also allows the rearrangement of notification widgets. From iOS 8 beta 3 onwards the "clear" button, used to clear notifications, is more visible. Users are now able to reply to text messages directly from the notification center.

Messages

In the Messages app, users can send audio and video messages by holding down the record button. In group conversations, users can add or remove someone from a thread, name a thread, share their location in a thread, view all attachments, and turn on Do Not Disturb to not receive notifications from a specific thread. Users can also set messages to auto delete after 30 days or a year.

Design

iOS 8 has the same design as iOS 7, however, transparency and other effects have been added. The multitasking screen now shows a list of recently called and favorited contacts.

Keyboards

iOS 8 includes a new predictive typing feature called QuickType. It displays word selections above the keyboard as one types. The feature can be turned off in Settings, or hidden using a swipe gesture. Additionally, iOS 8 will allow users to install third-party keyboards. Many developers stated they would port their keyboards to iOS, including Minuum, Swype, SwiftKey, Fleksy and Adaptxt.

Family Sharing

New to iOS 8, a user can add five others as family members. Family members can share purchased apps, music, and books using the same credit card. iOS 8 can also automatically set up photo streams for all family members. Calendars may be synced between all members. You can send iTunes download requests to another accounts for approval through Ask to Buy as long as you are signed up as a child.

iCloud Drive

Main article: iCloud Drive

iCloud Drive is Apple's file hosting service for devices running iOS 8 or OS X Yosemite. This feature allows users to save photos, videos, documents (Keynote, Pages, and Numbers), and music, and other apps' data to iCloud. Users can start their work on one device and continue on another device. By default, users will get 5 gigabytes of storage for free, but this space will be expandable via subscription.

HealthKit

Main article: Health (application)

HealthKit is a service that allows developers to make software that integrates with the new Health application. This application allows users to track their steps, oxygen, sleep levels, and other health related data. Additionally, users can enter their medical history, so that the application can help serve them better. In a commercial for the iPhone 5S, the exercise song Chicken Fat is used to promote the new service.

HomeKit

HomeKit is a framework that allows developers to make software that discovers, configures, communicates with and controls devices for home automation. Actions can be grouped together and can be initiated using Siri.

Handoff

This feature is supported only by compatible Macs with Bluetooth LE running OS X Yosemite, and by compatible devices running iOS 8. The following devices running iOS 8 will be supported: iPhone 5 or later, iPad (4th generation), iPad Air, iPad mini, iPad mini with Retina display, and iPod touch (5th generation).Handoff allows users to share documents, e-mails, and websites over Wi-Fi or personal hotspot between iOS 8 and OS X Yosemite devices. For example, when working on an email, Pages document, Keynote presentation, Numbers spreadsheet, viewing a location in Maps or browsing Safari on the Mac, on the lock screen of the iOS device it shows what app users are currently using on their Mac and will allow them to pick up where they left off in the app they were using on the Mac. This also works in the other direction. Users working reading email on their Mac running OS X Yosemite can then pick up their iPhone or iPad and see the application for mail in the bottom left corner and slide up from the app and their iOS device will open up the app right where they were on their Mac. Handoff also allows all text messages (not just iMessages as before) to be read and replied on their Mac and iPad. This also is extended to the uses of the voice function to make and receive call on their Mac and iPad if their iPhone is connected with iCloud.

Spotlight

In iOS 8, Spotlight is integrated with a number of web services so that users can search using Wikipedia, Bing, or Google. Other services include: news, nearby places, suggested websites, movie showtimes, and content that is not already on the device from the iTunes Store. Moreover, the enhanced spotlight search is also available in safari browser, so you can have now your own search engine that will find your desired stuff on services linked to spotlight search.

Wi-Fi Calling

In iOS 8, Apple integrated Wi-Fi calling. This service allows mobile phone calls over Wi-Fi. It is planned to be available for customers of EE in the UK. AT&T and Verizon are going to launch Wi-Fi calling in 2015. According to Computerworld, Vodafone might also provide this service to its customers in Australia. Since beta 3, Wi-Fi Calling is available to T-Mobile customers in the US.

Siri

Siri now outputs what users say as they speak for more accuracy and has integrated Shazam support. Holding down the home button will activate Siri, and saying "What's playing?" will identify what song is playing (since Beta 4, Apple removed listening by default).^{[citation needed]} Saying "Hey, Siri" whenever the device is plugged into a power source will activate Siri if the feature is turned on. Purchasing content through Siri is now possible, and Siri now has support for 22 new languages.

EU Internet

Since beta 4, Apple added EU Internet in the cellular settings to allow data roaming within the European Union only.