跳到主要內容

uncovering Android Master Key affects almost all android device

Security research team BlueBox has discovered a bug in Google’s Android operating system which could make 99 percent of all devices vulnerable to a frightening attack. A vulnerability in the OS could theoretically allow attackers to take control of an otherwise legitimate app. From here the attacker could steal information or control the device itself.
According to BlueBox CTO Jeff Forristal, this vulnerability has been present in Android for the last four years and could affect as many as 900 million devices around the world. BlueBox alerted Google about this vulnerability in February and will explain how the bug affects Android later this month at the Black Hat USA Security Conference in Las Vegas, Nevada.
“The vulnerability involves discrepancies in how Android applications are cryptographically verified & installed, allowing for APK code modification without breaking the cryptographic signature,” writes Forristal on the BlueBox corporate blog.
“All Android applications contain cryptographic signatures, which Android uses to determine if the app is legitimate and to verify that the app hasn’t been tampered with or modified. This vulnerability makes it possible to change an application’s code without affecting the cryptographic signature of the application – essentially allowing a malicious author to trick Android into believing the app is unchanged even if it has been.”

Bluebox's corporate blog and how to scan for the vulnerability

Read also comments from others:

blackhat 2013 conference

David Meyer's blog

bug explained and patch from Google


ZDNet 's truth about latest Google security scare

Symantec on this bug and situation in China

標籤：

留言

張貼留言

這個網誌中的熱門文章

Scythians 斯泰基 塞種 西古提人

900 BC - 200 AD British museum   Tomb of scythe prince, Buktarma valley, 1200 masl, Google map Herodotus   絲路上的帝國 Biblegeography   哥羅西書 3：11  在此並不分希利尼人、猶太人、受割禮的、未受割禮的、化外人、 西古提人 、為奴的、自主的．惟有基督是包括一切、又住在各人之內。 塞種 塞迦  saka 史記漢書 西域傳： 塞種  ctext 昔匈奴破大月氏，大月氏西君大夏，而塞王南君罽賓。塞種分散，往往為數國。自疏勒以西北，休循、捐毒之屬，皆故 塞種 也。 匈奴列傳 Ctext ：塞王 《史記》在《大宛列傳》與《匈奴列傳》中， 詳細 記錄了中亞至天山一帶的塞種（塞王、塞地）狀況。例如，文中記載了月氏西破走塞王，導致塞人南遷越過懸度（今帕米爾高原及克什米爾一帶） Baike Genetic history   Genetics  Nih griffin  ? Scytho-Siberian  world 塞迦 saka  wiki Disappeared? Sarmatians （ 薩爾馬泰 ， 奄蔡 史記 ,  Aorsi ）and goths YouTube  
張貼留言
閱讀完整內容

calculate pH of phosphoric acid

Question: adding 1/4 teaspoon of 10% phosphoric acid  to 19 litres of water, what will be the pH? Let's go through the calculations step by step. Step 1. Convert mass ( or volume) of 10% phosphoric acid to mole per litre ( mol/L) The above calculation shows that 1/4 tsp of H3PO4 acid is 6.97e-5 mol/L Step 2. Input this value to BATE (or other app) to calculate pH The answer: pH = 4.16, ie too acidic !? If you use pipette instead of teaspoon,  1 drop = 0.05ml. So 1/4 TSP means roughly 25 drops If you actually aim for pH 5.6 (which is optimum pH for mashing), conc will be 2.51 e-6, or 1/100 tsp , 0.044 ml, roughly 1 drop Let's roll back a bit. From  recipes of   BarleyWine , summer rye , hefe Gordon Strong suggested to use 1/4 teaspoon of 10% phosphoric acid, which is targeting pH of 5.5..... Discussion on  homebrewtalk  forum. However using online BF water calc , Sparge pH would be 4.6. but he also added 1 tsp of CaCl2. 2H20. Mash pH change from 5.7 t...
張貼留言
閱讀完整內容

ES8311 and ES8388 codec IC

ES8388 audio codec module is one of the audio codec modules available that is supported by ESP32 and official ESP-ADF releases. The ES8388 module lets you have: Stereo microphone and line input Stereo headphone and line out Up to 96 kHz 24 bpp high quality audio This module is compatible with all MCUs that have I2C and I2S ports (like ESP32, ESP8266, STM32, i.MX6, Raspberry Pi, etc) ES8311 Maxgerhardt github PCBartist twblogs ESP32-A1S  (limited stock)Audio codec AC101 or ES8388 built-in. NB the pinouts and firmware are different! Arduino - ESP31-A1S instructable Phil Schatzmann and his github   Simple A2DP thaaraak github on ESP32-A1S github of Yveaux and  Marcel-licence ESP ADF   example:  Logitech PiCorePlayer squeeze lite squeezebox forum   ESP32-Audio-kit  (from AI thinker) based on ESP32-A1S, is simple and small. But upgrade-ability seems limited  Alex John Talbert mixer equalizer: can this be used as simple equalizer? how about proces...
張貼留言
閱讀完整內容