Tuesday 22 December 2015

How to Turn Any Non-Touch Screen PC Into a Touch Screen

How to Turn Any Non-Touch Screen PC Into a Touch Screen
Want to buy a touch-screen laptop but couldn’t afford it?
But what if I told you that you can turn your existing non-touch-screen laptop into a Touch Screen laptop?
Yes, it’s possible. You can now convert your laptop or PC into a touch screen with the help of a new device called AirBar.
Touch screen has become a popular feature on laptops these days, and many laptops are moving toward having touch screens, but not every laptop or desktop model comes with the feature.
Swedish company Neonode has brought to you a new device, AirBar, that would bring the touch technology to virtually any computer from your non-touch laptops to notebooks.

What is AirBar and How does it Work?

AirBar is a small plug-and-touch bar that attaches magnetically to the bottom of your machine’s display.
When connected to your laptop via an available USB port, AirBar starts emitting a beam of invisible light across your screen that is used to track touchscreen movements and gestures.
The movements and gestures are then translated into corresponding inputs, making you able to use all the gestures including poking, pinching, swiping, zooming and scrolling around with your hand, in the same way, like on a touchscreen PC.

Video Demonstration

AirBar turns any laptop, computer, or notebook into a touchscreen machine, without making any changes to its hardware.
You can watch the video below to know how really AirBar works.
And What’s Great about AirBar is that…
…it even works if you have worn gloves, and with any other object.
AirBar works well with any device running Windows 8 or Windows 10 or even with a Chromebook, but it still needs to have proper OS X support.
The AirBar is going to retail for $49 next month with its public launch in January 2016 at the CES event in Las Vegas. 15.6-inch screens size at present. Currently, the only size that AirBar accommodates is 15.6-inch screens.

How to Crash Your Friends’ WhatsApp Just By Sending Crazy Smileys

whatapp-crash
What would require crashing the wildly popular WhatsApp messaging application?
Nearly 4000 Smileys.
Yes, you can crash your friends’ WhatsApp, both WhatsApp Web and mobile application, by sending them not any specially crafted messages, but just Smileys.
Indrajeet Bhuyan, an independent researcher, has reported a new bug in WhatsApp that could allow anyone to remotely crash most popular messaging app just by sending nearly 4000 emojis to the target user, thereby affecting up to 1 Billion users.
Bhuyan is the same researcher who reported a very popular WhatsApp crash bug last year that required 2000 words (2kb in size) message in the special character set to remotely crash Whatsapp messenger app.
After this discovery, the company patched the bug by setting up the limits of characters in WhatsApp text messages, but unfortunately, it failed to set up limits for smileys send via WhatsApp.
“In WhatsApp Web, Whatsapp allows 65500-6600 characters, but after typing about 4200-4400 smiley browser starts to slow down,” Bhuyan wrote in his blog post. “But since the limit is not yet reached so WhatsApp allows to go on inserting…when it receives it overflows the buffer and it crashes.”
whatsapp
The recent bug tested on Android devices by multiple brands and successfully crashed:
  • WhatsApp for Android devices including Marshmallow, Lollipop and Kitkat
  • WhatsApp Web for Chrome, Opera and Firefox web browsers.
It is sure that the latest version of WhatsApp is affected by this bug

Video Demonstration

You can also watch the Proof-of-Concept (PoC) video that shows the attack in work.

How to Protect Yourself

Bhuyan told hat he had reported the WhatsApp crash bug to Facebook. However, before the company patches the issue, there is a simple way out.
If you become a victim of such message on WhatsApp, just open your messenger and delete the whole conversation with the sender.However, remember, if you have kept some records of your chat with that particular friend, you’ll end up losing them all.
At the beginning of this year, Bhuyan also reported two separate bugs — WhatsApp Photo Privacy bug andWhatsApp Web Photo Sync Bug — in the WhatsApp web client that in some way exposes its users’ privacy.

Thursday 17 December 2015

Hacker Confirms PlayStation 4 Jailbreak! Exploit Could Open Doors for Pirated Games

Sony’s PlayStation 4 – the hottest-selling gaming console in the United States – has been in the market for a while now, and since its release, hackers have been tinkering with it to find a way to run unauthorized software.
Though breaking the protection on PlayStation 4 is a huge deal, a hacker who calls himself CTurt has claimed to develop a fully jailbroken version of the PlayStation 4 with the help of a kernel exploit that he previously created.
The current jailbreak allows dumping of the system RAM from other processes and installing custom firmware that can be used to run homebrew applications that aren’t approved by Sony.
Of course, there is still a few other security issues to get by, but it is a foot in the door for game piracy, which can affect the gaming market as a whole.
The Twitter account of CTurt seems to indicate that currently the exploit only works for PlayStation 4 firmware version 1.76, but apparently it can be tweaked to work for more recent firmware.
ps4-PlayStation-jailbreak
CTurt successfully managed to take advantage of an exploit in PlayStation 4 v1.76 to inject an external code in the system, thereby taking control of the hardware.
Sony would certainly be unhappy with the launch of PlayStation 4 jailbreak and would be trying hard to eliminate any vulnerabilities for the most recent version of PS4 firmware.

British Intelligence Open-Sources its Large-Scale Graph Database Software

Open-Source-large-scale-database
UK’s Secretive Spy Agency Government Communications Headquarters (GCHQ) has open-sourced one of its tools on code-sharing website GitHub for free…
A graph database called ‘Gaffer.’
Gaffer, written in Java, is a kind of database that makes it “easy to store large-scale graphs in which the nodes and edges have statistics such as counts, histograms and sketches.”
Github is a popular coding website that allows software developers to build their project on a single platform equipped with all the requirements that are gone in the making of a software.

Gaffer and its Functionalities

In short, Gaffer is a framework for creating mass-scale databases, to store and represent data, and is said to be useful for tasks including:
  • Allow the creation of graphs with summarised properties within Accumulo with a very less amount of coding.
  • Allow flexibility of stats that describe the entities and edges.
  • Allow easy addition of nodes and edges.
  • Allow quicker retrieval of data on nodes of interest.
  • Deal with data of different security levels – all data has a visibility, which is used to restrict who can access data based on their authorizations.
  • Support automatic age-off of data.
Gaffer actually uses the Apache Accumulo codebase that was originally open-sourced by the USNational Security Agency (NSA) and is released under the Apache 2.0 licence.

Why GCHQ Open Sourced its Code?

It’s pretty unusual for one of the most secretive intelligence agencies to release computer code online for anyone to use for free.
Because GCHQ is very well known for monitoring communications worldwide and is not at all expected to release its database types open source on GitHub.
However, maybe this GCHQ’s move is part of its effort toward becoming friendlier in the hacker community and to attract new talents.
The spy agency also says that it is already started working on Gaffer2, a project the agency aims to take“the best parts of Gaffer… to create a more general purpose graph database system.”
What do you think about this GCHQ’s move? Feel free to tell us by hitting the comments below.

कम्‍प्‍यूटर का माउस बताएगा आपके मूड का हाल

आप उदास मन से किसी वेबसाइट पर माउस घुमा रहे हैं कि अचानक उसका रंग बदलता है और पॉप अप के रूप में कुछ चुटकुले आकर आपको हंसा देते हैं। सुनने में भले ही ये किसी सुपर इंटेलीजेंट कंप्यूटर का कमाल लगता हो, लेकिन आने वाले दिनों में ऐसा आसानी से हो सकता है।
दरअसल, दिनोंदिन आपके करीबी दोस्त बनते जा रहे कंप्यूटर के माउस का कर्सर आपके मूड की आसानी से चुगली कर सकता है। शोधकर्ताओं ने ऐसा तरीका खोज निकाला है जिससे माउस के जरिये आपके मूड का पता लग सके।
अमेरिका की ब्रिघम यंग यूनिवर्सिटी के शोधकर्ता जेफरी जेनकिंस ने बताया कि लोग जब गुस्से, तनाव या दुख जैसी किसी भी नकारात्मक भावना से ग्रस्त होते हैं, तो माउस को हिलाने का उनका तरीका बदल जाता है। उन्होंने कहा कि इन स्थितियों में माउस को हिलाने की गति में भी बदलाव हो जाता है।
आधुनिक तकनीक की दुनिया में कुछ ऐसे तरीके आ चुके हैं, जिनकी मदद से माउस के कर्सर की गतिविधि से जुड़ा पर्याप्त डाटा आसानी से जुटाया जा सकता है। इनकी सहायता से आपके मूड का पता लगाना भी संभव है। जेनकिंस ने कहा, “आने वाले दिनों में वेबसाइटें सिर्फ आपको सूचना ही नहीं देंगी बल्कि वो आपकी भावना को महसूस भी कर सकती हैं।”
शोध में कहा गया कि मन अस्थिर होने पर लोग आमतौर पर माउस कर्सर को टेढ़ा-मेढ़ा और तेजी से घुमाते हैं। वहीं कुछ लोग निराश होने पर कर्सर को बहुत धीरे-धीरे चलाने लगते हैं। शोधकर्ताओं का कहना है कि अपने यूजर की भावनाओं को समझकर भविष्य में वेबसाइटें उन्हें कुछ खास अनुभव देने में भी सक्षम हो सकती हैं।

Wednesday 2 December 2015

Top 5 Skills for IoT Testers

Testing the Internet of Things presents unique challenges. For starters, the IoT itself is a vast system of networked devices, sensors and computing infrastructure, with potentially tens of billions of moving parts within it by the end of this decade. Cisco has estimated that 50 billion “things” could be connected to the IoT by 2020 – enough for each person on the planet to have six of them to his or her name.
In addition to its unprecedented scale, the IoT is also a complex realm of crisscrossing wireless connections and long device idle times. Everything from environmental sensors and motion detectors to networked refrigerators and thermostats will be counting upon available connectivity via Wi-Fi, Bluetooth, ZigBee, 4G LTE and other technologies. At the same time, these nodes within the IoT will behave differently than many traditional devices: They may consume data mostly through “bursty” transmissions rather than in a steady stream.
Software quality assurance members tasked with performing software testing of applications and services for the IoT must be prepared for a new frontier. They must be ready to take on fresh challenges with data security, connectivity, maintenance and embedded systems that they have may not encountered much in previous projects. Let’s look at five key skills that IoT testers will need for success:
1) Comfort with conducting gray-box testing
Testing something for the IoT will often put teams in a gray-box situation, meaning that they will need to not only verify the functionality of the application (as in white-box testing) but also dive into its internal structures (as in black-box testing). This is because developers may have limited control over how their creations will ultimately be used – a similar scenario to what already happens with services such as Netflix, which can be accessed from a multitude of interfaces – and as such won’t get the transparency of white-box testing.
Success with gray-box testing depends on gathering as much information as possible about relevant APIs, third-party services, connectivity protocols, etc. This data can then be used to craft effective test cases that can cover a wide range of events and circumstances.
2) Knowledge of embedded systems
As mobile applications entered the mainstream over the past decade, testers had to become accustomed to issues that had rarely, if ever, been relevant with desktop programs. For example, they had to address touch-based interfaces, mobile connectivity fluctuations and limited battery life. The IoT will force a similar shift, in part because of its many embedded systems.
Unlike platforms like Apple iOS or Google Android, these systems aren’t known for their well-maintained operating systems and support tools. More often, they are essentially kludged together. Testers may need to work more directly with end-user interfaces and tools such as code tracers to ensure proper coverage in their tests.
3) Ability to perform effective simulation
The scale and complexity of the IoT means that many of its environments cannot be recreated in full for testing purposes. Testers have to rely instead on simulation, often with many virtual networks complementing a single physical one. This is the most efficient way to recreate the feel of hundreds or even thousands of nodes operating in tandem.
Simulators provide advantages on top of their cost-effectiveness and scalability. For example, they can accelerate the testing process for systems with long idle times by only processing interesting events, rather than the long intervals between them. Idle execution is sped up, saving time and money for testers.
4) Dealing with data spikes and bursty usage patterns
In the virtual desktop infrastructure world, there’s a phenomenon called the “boot storm,” when everyone tries to sign into their VDI solutions at the same time (usually in the morning). The result is lag and an overall poor user experience. What does this have to do with the IoT, though?
IoT application and service testers may have to take a similar situation into account when working with any software that governs areas such as utilities or transportation. What could rush hour traffic due to highway systems? Can the network handle the data spike from all the lights coming on at once in a building after an outage? These scenarios are new territory for most QA teams.
5) Data security wherewithal
The IoT has been a fixture of cyber security conversations for years now. The potential issues are well-known. As Nicholas Evans noted for Computerworld, security is sometimes an afterthought for IoT vendors. Moreover, the sheer diversity of devices, applications and services in play makes it hard to implement an effective catch-all defense strategy.
IoT testing teams must be attentive to everything from transit encryption to API integrity and use of test management add-ons for Atlassian and utilities as needed. The stakes for protecting connected cars, homes and businesses from intrusion are higher than ever with the IoT.
Thanks K Shilpa Sutar

Patent Troll — 66 Big Companies Sued For Using HTTPS Encryption

patent-troll-https-encryption
Are you Using HTTPS on your Website to securely encrypt traffic?
Well, we’ll see you in the court.
At least, that’s what CryptoPeak is saying to all big brands that utilize HTTPS on their web servers.

BIG Brands Sued for Using HTTPS: ‘Patent Troll’

Texas-based company CryptoPeak Solutions LLC has filed 66 lawsuits against many big businesses in the US, claiming they have illegally used its patented encryption method – Elliptic Curve Cryptography (ECC)– on their HTTPS websites.
Elliptic Curve Cryptography (ECC) is a key exchange algorithm that is most widely used on websites secured with Transport Layer Security (TLS) to determine what symmetric keys are used during a session.
Encryption is on the rise after Edward Snowden made the world aware of government’s global surveillance programs. Today, many big tech and online services are using encryption to:
  • Protect the data transmitted to/from visitor to domain
  • Lessen the risk of hacking
However, websites using the ECC key are now at risk of being forced to court for using the protocol. As CryptoPeak snapped up the Patent (US Patent 6,202,150) that describes “Auto-Escrowable and Auto-Certifiable Cryptosystems,” which the firm argues covers elliptic curve cryptography (ECC).

Either Pay or Don’t Use HTTPS

The abstract of the US Patent 6,202,150 describes the invention, which was granted in 2001:
patent-troll

Companies Targeted by CryptoPeak

Some of the biggest names CryptoPeak Solutions sued include:
  • Yahoo
  • Netflix
  • Pinterest
  • AT&T
  • Sony
  • Groupon
  • GoPro
  • Etsy
  • Petco
  • Target
  • Costco
  • Home Depot
  • Expedia
  • Barnes & Noble
  • Multiple financial institutions and hotel chains
You can see the full list of lawsuits, which is available online here.
“Defendant has committed direct infringement by its actions that comprise using one or more sites that utilize Elliptic Curve Cryptography Cipher Suites for the Transport Layer Security (TLS) protocol (the Accused Instrumentalities),” according to the lawsuits.
CryptoPeak can easily be categorized as a “Patent Troll,” as it is still unclear if the cases will be successful or not. Since the patent describes some of the key tenets of ECC, which includes generating and publishing of public keys, not obvious corresponds directly to its implementation in HTTPS connections.
Some companies targeted by the firm are fighting the lawsuit that seeks damages and royalties, and other like Scottrade are doing out of court settlements, saying “all matters in controversy between CryptoPeak and Scottrade have been settled, in principle.”
Netflix, one of over 60 companies being dragged to court, called CryptoKey’s lawsuit “invalid” from the outset and filed a case to be dismissed under FED. R. CIV. P. 12(B)(6).
“The defect in these claims is so glaring that CryptoPeak’s only choice is to request that the court overlooks the express words of the claims, construe the claims to read out certain language, or even correct the claims,” Netflix said (PDF) in a court filing.

Adobe to Kill ‘FLASH’, but by Just Renaming it as ‘Adobe Animate CC’

Adobe is Finally Killing FLASH, but not actually.
Adobe Flash made the Internet a better place with slick graphics, animation, games and applications, but it never stood a chance of surviving in the same world as HTML5.
Of course, Flash has plagued with various stability and security issues, which is why developers had hated the technology for years.
So, now it’s time to say GoodBye to Adobe Flash Professional CC, and Welcome Adobe Animate CC.
Meet the new Flash, Adobe Animate CC, same as the old Flash, and still insecure mess.

Adobe Animate CC Embraces HTML5

Adobe has officially announced that “over a third of all content created in Flash Professional today uses HTML5,” so the company is acknowledging the shift with the new name.
Adobe Animate CC — Adobe’s Premier Web animation tool for developing HTML5 content.
Yes, that’s what the company has the focus on.
The application – mostly looks like an update to the Flash Professional software – will still support Adobe Flash (SWF) and AIR formats ‘as first-class citizens,’ along with other animation and video formats, including HTML5 canvas, 4K and WebGL output.

Adobe Animate CC is the Same Old Flash

When Adobe Animate CC launches in January 2016, it will bring features like easy access to high-quality stock art, new vector art brushes, as well as the ability to rotate the canvas 360° from any pivot point. Sounds exciting!
What it won’t bring is:
  • Fix for the number of security issues that have plagued Adobe Flash for years
The platform has a new name, but the development tool lives on.
So, Flash isn’t actually dead; it’s just renamed.
“Adobe’s strategy is to make money regardless of what happens in the market,” says Jeffrey Hammonds, principal analyst at Forrester Research. “They understand that there is a slow transition to HTML5 going on.”
“At some point you have to embrace the change,” Hammond adds. “The rebranding is the visible sign of that, but the internal focus on supporting the technologies like HTML5 has been going on a while.”
So, hiding Flash behind a different name doesn’t solve the stability and security issues. In fact, a recently uncovered flaw in the software was so nasty that the only way to get rid of it was to completely uninstall Flash Player.

Toymaker VTech Hack Exposes 4.8 Million Customers, including Photos of Children

vtech-toymaker-hacked
Earlier this month, a massive data breach at VTech – the maker of tablets and gadgets aimed at children – exposed the personal details of about 4.8 Million parents and photos of more than 200,000 Children.
If that was not bad enough…
…it turns out that the massive cyber attack against the toymaker company also left hundreds of thousands of snaps of parents and children, as well as a year worth of chat logs kept online in a way easily accessible to hackers.

VTech Data Breach

In a statement released Monday, the toymaker company VTech said the hacked database included victim’s profile information including:
  • Customers’ names
  • Email addresses
  • Passwords (One-way encrypted using MD5 hash that can be cracked in no time)
  • Secret questions and answers for password retrieval
  • IP addresses
  • Residential addresses
  • Download history
The database also included information on children including names, genders and date of births.
However, the Hong Kong-based company noted the database didn’t contain any credit card or personal identification information like social security numbers (SSNs) and driver license IDs.

Hack Leaks Photos and Chat Logs of Children & Parents

What’s even more worrisome is that…
In addition to the above information, data from Kid Connect – a service VTech offered to let parents communicate with their kids – was also hacked. Kid Connect information included:
  • Pictures of Children and parents
  • Chat logs between parents and children

How did VTech Data Breach Happen?

The massive data breach actually occurred on Nov. 14 and impacted VTech’s Learning Lodge app store database, which features learning game apps and other educational tools for kids to download on their VTech devices.
The kiddie toymaker company had alerted Learning Lodge customers of the recent hack, and had “temporarily suspended” the Learning Lodge site along with 13 of its associated websites as a precautionary measure, VTech said on its website Monday.
The hacker that discovered the data breach told Motherboard that he has no plans to misuse the leaked information he gathered.
However, now, when the information – including snaps and chat logs – is available online, it could be even harder for VTech to try to pretend that everything is all right.
VTech says it is still investigating the matter, and will look into new ways to strengthen its security. It also alerted customers of potential exposure, encouraging them to follow up with the company via email (vtechkids@vtechkids.com in the U.S.).

Experts Warn of More Cyber Attacks

Now that the massive database from VTech is available online, security experts are warning that hackers and cyber criminals are likely to use this information in order target similar IoT (Internet of Things) companies that handle customer data.
Breaches like VTech are not unusual, but since it involves services aimed at children that generally do not get much of the attention when it comes to the security of data.

Affected? How to Check and What to Do?

If you are a parent holding a Learning Lodge account, you are advised to check Have I Been Pwned?website, which compiles all the data from breaches and now includes users accounts stolen from VTech.
If you found your Learning Lodge account affected, you should:
  • Change your password immediately
  • Also, change your password retrieval information
You are also advised to change the passwords on any other online accounts for which you are using the same password as for Learning Lodge account.