Yahoo to roll out printed Flickr photo books

 

Flickr is adding a one-click photo book feature for its users, Yahoo's photo-sharing site announced Tuesday. Users need only to click the book icon on any of their sets, according to Flickr, and the site will automatically generate a photo book. Flickr is promising that the bound books are laid out to optimally showcase a photographer's work.

That includes simple layouts, placement of one photo per page, and tools that will "analyze, crop, position, and rearrange your photos to look their best," the Flickr blog reads. Users can also go in manually and make tweaks, delete images, or reorder the pages.
Starting next week, US users will actually be able to purchase the books, which Flickr said are printed on premium photo paper. Users outside the continental US will have to wait longer. "Please stay tuned. We are working on bringing you Flickr Photo Books soon," the blog says.
The books can run from 20 to 240 pages, and they'll start at $35 for a 20-page book. It's 50 cents per page after that, according to Yahoo.

It's unclear what this new process means for Flickr's partnership with HP's Snapfish, which was the source for Flickr photo books. Previously, when users selected a photo set and then clicked on the photo book option, Flickr would connect them to Snapfish. Now it's difficult to surface that option. A Yahoo spokeswoman said the "Snapfish partnership remains. This is entirely separate."
Yahoo won't say what vendor is actually powering the printing behind these new photo books, or if it has plans to add any other printed products, like T-shirts or mugs.

Xbox One's Twitch gameplay streaming delayed until 2014

 

 

The ability to stream your gameplay footage through the popular Twitch service will not make its way to the Xbox One until 2014, Microsoft announced Tuesday.
In a blog post that shed more light on Twitch integration for the console, which hits store shelves this Friday, November 22, Microsoft noted that the Xbox team is "working to ensure the initial Twitch on Xbox One broadcasting experience meets the expectations of the Twitch community."

"While this feature won't be available right away, we'll let you know as soon as it is ready. Our goal is to deliver it during the first part of 2014," it reads.
While clearly not a deal breaker, gameplay streaming will surely be missed on the Xbox One. It's an increasingly more popular activity that will begin to move beyond the hardcore gaming community that has rallied behind its two most robust platforms, Twitch and Ustream, especially as Sony and Microsoft both embrace live streaming as a core social feature of game playing moving forward.
Sony offers streaming to both Ustream and Twitch on its PlayStation 4, which has generating hundreds of videos in the less than one week's time since its launch.
The Xbox One's Twitch.tv app will however let users view others' streams in the meantime. The console will also allow players to record up to five minutes of gameplay and share it via Xbox Live or to one's SkyDrive account.

Essential steps for securing your phone, and what else can be done to foil thieves

From left, the Find My Phone feature on Windows Phone, the Find My iPhone app on iOS, and Android's pattern unlock feature.

 

 

It could happen to you any time, or maybe it already has: You're on the bus playing Angry Birds or browsing Facebook on your phone, when someone snatches your handset, sliding out the closing doors and slipping away into the crowd. Or, worse, a thief takes your phone from you at gunpoint. However it happens, there's no recourse. Your phone is gone, and while you always can buy another handset, all your personal information now lives in the hands of a criminal, petty or otherwise.
According to the San Francisco Police Department, more than 50 percent of the robberies that occurred in the city in 2012 involved the theft of a smartphone (the robberies are referred to as "Apple Picking"). That's nothing to discount, and remember that the SFPD only tracks data for crimes that were reported. The fate of your phone after it's stolen could be just about anything. A thief may keep it himself, she may sell it to a friend or an unsuspecting buyer on eBay, or it may have been stolen only for the parts. Other phones may even be smuggled out of the country where they can fetch a premium price in developing markets. For more on that market, check out this comprehensive story from Huffington Post.
That's why if you own a smartphone and bravely brandish it on the street or the train, it's essential that you take every step necessary to protect your data from thieves, and to track and manage your smartphone once it's gone. In this feature, I've described the essential security features available for each smartphone operating system and the major US carriers. Also, read Jessica's Dolcourt's smart tips for safe phone use in public. The wireless industry is taking some steps to confront phone theft like the creation of a national phone "blacklist," but that's as far as it's willing to go for now. Some law enforcement agencies, particularly those in San Francisco and New York state, want a "kill switch" that would essentially brick a phone, but carriers and OEMs are balking at that idea. I'll discuss both issues in more detail below.

Before I begin
First, there are a few things that you should know. In the first section, I've divided each operating system into two parts: the basic security features which come on the smartphones for preventing data theft that use an OS, and the more sophisticated app-based services available for tracking and wiping a device. Note also, I purposely did not include any third-party security apps. Though such titles exist, and many will do the job quite well, my intent is to focus on the default solutions that are either already on a handset, or officially endorsed by an OS provider.
Also, keep in mind that no security feature is completely foolproof. A sophisticated thief with the right equipment may be able to bypass any security measure. What's more, there's always the chance that a thief is stealing your phone just for parts, and has no intention of reusing it. In that case, a password isn't going to stop him from just taking it apart.

iOS

Preventing data theft and casual hacking

Lock code
You can use either a 4-digit number (a "simple passcode") or a longer "complex passcode" of case-sensitive letters, numbers, spaces, and characters. And if you prefer, you can activate a feature where entering a passcode incorrectly 10 times will wipe the phone. The iPhone 5S has the same passcode features, with an added Touch ID fingerprint scanner.

Lock screen features
This is important. iOS can give you access to some features without entering your lock code. Though sensitive personal information is not accessible, you can use some functions of Siri, such as placing a voice call or sending a text message, as well as reply to a missed call with a canned text message. Though you might find those shortcuts convenient, your handset will be more secure if you turn them off. Go to Settings > General > Passcode Lock.
Similarly, you'll also need to turn off access to the Control Center and the Notification Center from your lock screen. To get there, go to Settings > Control Center, and Settings > Notification Center.

Tracking and wiping your phone

Find My iPhone

This feature enables you to track, manage, and secure your phone once it's missing. To use it, you'll first need an iCloud account, though you do not need to sync any of your data, like e-mail and contacts, to the cloud. After you're set up, then go to the iCloud page of your iPhone's Settings and slide the Find My iPhone toggle to on.

After you sign into your iCloud account, click on the Find My iPhone option.

Once your phone has been stolen, the first step is to sign on to iCloud.com or use the free Find My iPhone app on another iOS device. Once in, you'll be able to find your device on an Apple map, but only if it is connected to a cellular or public Wi-Fi network (both secure and not). If the phone is connected just to a hidden Wi-Fi network (that is, one that does not appear in your handset's list of available networks), you may not be able to track it. Other restrictions also apply, but I'll get to those later.
After locating your phone and clicking on the icon, you can do a number of things. The first is to make the phone make play a sound at full volume for two minutes (even if it's in silent mode). As this step is more useful if you just happen to lose your phone in your sofa cushions, I'd advise not using it if you're certain that your handset is stolen. It just won't do a lot of good except annoy a thief. You also can erase your handset completely, but this step is rather premature. Instead, first try activating Lost Mode as soon as you as you can. Not only does it give you more options for controlling your phone, it also adds a stricter level of security.

 

The online interface for Find My iPhone.

Lost Mode
Lost Mode does a couple of things, the first of which is give you more features for controlling your device. To begin, if you haven't yet secured your device with a passcode (and, really, there's no reason why you shouldn't), you'll be able to select a four-digit simple passcode and lock the screen remotely. At the very least, that will prevent all but the most sophisticated thieves from accessing your personal information. Remember, though, that to make your phone as secure as possible, you should have already deactivated lock screen access to the features I mentioned previously.
The next step is to send a custom message to your handset's lock screen that can't be erased. You can write whatever you want, from your name or phone number, to a plea to contact you, to a more colorful message telling thieves what you really think of them. The latter, however, probably isn't the wisest course of action.
Lost Mode also lets you see a history of your phone's location over the last 24 hours with points displayed as pins on the aforementioned map. Finally, if all hope is gone, you can erase your device completely. Once you erase it, you'll lose the ability to track it further, but your lock code and onscreen message will remain.
Comparing Security features by OS

Feature	iOS	Android	Windows Phone
Mobile app	Yes	No	No
Device Tracking	Yes	Yes	Yes
Remote wipe	Yes	Yes	Yes
Remote screen lock	Yes	Yes	Yes
Play a sound	Yes	Yes	Yes
Onscreen message	Yes	No	Yes
Prevent new activations	Yes	No	No
Lock code choices	4-digit PIN or password	4 to 17-digit PIN, password, pattern, or face unlock	4 to 16-digit PIN only
Features accessible from lock screen	Siri (including placing a call, or sending a text), Notification and Control centers	Missed calls & text messages	None

Activation Lock
Lost Mode also plays a role in Activation Lock, which is a few feature added in iOS 7. Built after Apple users rightfully complained that Find My iPhone wasn't comprehensive enough, Activation Lock tries to close the loop by preventing a thief from reusing your device after you've accepted that it's gone for good.
Running in the background from the moment you turn on Find My iPhone, Activation Lock pairs your Apple ID and password with the serial number of your handset in Apple's servers. Your ID and password are then required before anyone can turn off Find My iPhone on your handset, attempt to erase any data (that's assuming they aren't stopped by your password), reactivate your phone under a different account, or claim a new phone under your warranty. Activation Lock also remains in place if a thief tries to swap out your SIM card. If you happen to get your phone back and can't remember your password, you can retrieve it by calling Apple support and properly identifying yourself.

Now, the fine print
Don't forget that Find My iPhone only works as long as your device is online through your carrier's cellular network or Wi-Fi. If a thief turns off your phone or manages to activate Airplane Mode, you won't be able to track it. You can send commands to erase the phone, lock it, and add an onscreen message, but those commands won't be carried out until the phone reconnects. There may be a short gap between when a phone comes back online and when your request to erase it comes through, but setting a passcode ahead of time will keep a thief from accessing anything during that period.
The bottom line
Between Find My iPhone and Activation Lock, iOS has the most comprehensive solutions for protecting your phone (iPhones also are the most popular smartphone targets for thieves). As a result, though, you need to spend more time getting everything set up and running. And with so many features accessible from the lock screen at default, there's more responsibility on the user to lock down the phone as tightly as possible.

Android

Preventing data theft and casual hacking

Lock code
You can secure your handset with either a numerical PIN of four to 17 digits, a password of case-sensitive letters, numbers, and characters (but no spaces), or a pattern. If you use the latter, though, remember that a thief may be able to see your unlock pattern by following the finger smudges on your display. That's another reason why it's a good idea to wipe your handset's screen often. Android phones that run Jelly Bean and above also have the face unlock feature. That feature can be a kick, but it's definitely the less secure option. Beyond a lock code, the new HTC One Max has a fingerprint scanner. Lock screen features
Like with iOS, Android will let you access some features from the lock screen. The list here is smaller -- just your missed calls and a preview of any missed texts -- but you must disable access by accessing the Security page of the Settings menu.

Tracking and wiping your phone

Android Device Manager
Similar to Find My iPhone, Android Device Manager lets you control access to your phone if it's stolen. Activate the feature by going to the Google Settings menu and choosing Android Device Manager option. Then, check the boxes for remotely locating, locking, and resetting your phone.

Locate your phone with Android Device Manager

To locate a lost device, you'll first need to sign onto the Android Device Manager site using your Google ID and password (there's no corresponding mobile app in Google Play). You'll then see a list of all devices connected to your account. Clicking on each device will show you its location on a Google Map. Of course, the device must be connected to a cellular network or a public Wi-Fi or you won't be able to locate it.

Setting up Android's Face Unlock feature

The next set of options include the ability to lock the your phone with a new lock code, make it ring for five minutes at full volume (even if it's set to silent), and erase your handset completely. Though Android Device Manager does not have an official "Lost Mode," you still can take most of the same preventive measures that you can with iOS, except adding a message to your device's home screen (that option isn't available here). Android does not have its own version of Activation Lock either, but such features are available through third-party apps.

Now, the fine print
Like with iOS, you won't be able to track a device that is powered down or offline. If you send any commands to the phone during that period, though, they also will be carried out when the handset reconnects. You will not be able to track a device after you wipe it, but you will be able to track it if the thief swaps out the SIM card. Also important: you can't wipe microSD cards remotely, only the phone's internal memory. So be careful what you store on a memory card.

The bottom line
Android delivers the essential protection features in an attractive, easy-to-use interface and it runs circles around its rivals with lock code options (big points for the ability to use spaces). On the other hand, the ability to add an onscreen message and a mobile app would make Android Device Manager even more useful. Also, Google needs a service comparable to Apple's Activation Lock.

Windows Phone

Preventing data theft and casual hacking

Lock code
Though you can lock your phone only with a four to 16-digit PIN, Exchange users can add a separate code to access their e-mail. Windows Phone does not make features accessible from the lock screen.

Tracking and wiping your phone

Find My Phone
As this feature is active from the moment you start using your handset, there's no separate set up process. Yet, you can choose to save your handset's location periodically on Microsoft's servers under the Find My Phone option in the Settings menu. Doing so will make it easier to find your device and track its movements. If your device is stolen, sign into WindowsPhone.com using your Microsoft ID, select your handset from the drop-down menu at the top right of the page, and choose the "Find My Phone" app. Microsoft does not offer a companion Find My Phone mobile app.

Find My Phone has a plainer interface, but it's just as useful.

As long as your device has a cellular or public Wi-Fi connection, you'll see a Bing Map with your device's approximate location and three options. They include making it ring (even if it's in silent mode), erasing it completely, and locking it with a PIN. If you choose the latter, you also have the option to make the phone ring as it locks and add a message on the screen. Windows Phone does not have anything directly comparable to Apple's Activation Lock.
Now, the fine print
Here again, you won't be able to track a device that that's off or not connected to the network. But, if you send any commands to the phone during that period, they will be carried out when the handset reconnects. Also, if you can't find your device right away, Microsoft's system will keep trying to locate it, which saves you from constantly refreshing the page. And if you wish, Microsoft will send you an e-mail when it pinpoints your device's location. Like with iOS and Android, you won't be able to track a device after you wipe it, but you will be able to track it if the thief swaps out the SIM card.

Find My Phone will send you an e-mail like this when it locates your device.

The bottom line
There's no set-up process and Windows Phone deserves praise for offering features that Android lacks (an onscreen message and the automated e-mails). Yet Microsoft needs to give customers a mobile app for Find My Phone and its own version of Activation Lock.

Carriers

All US carriers will suspend service to your phone once you report it as lost or stolen. When you make the report, the unique number that identifies your phone to the carrier (called an IMEI on a GSM phone, and an ESN on a CDMA phone) will be entered in a "blacklist." As a result, the network will reject service (calls and data) to any device if its IMEI or ESN is on the list (it would be able to access Wi-Fi, though). Also, since the IMEI on a GSM phones is independent from the SIM card, swapping the SIM for the same carrier would not make a difference. It's a different story if your handset is unlocked, but I'll get to that later.
Sprint, AT&T, and T-Mobile have partnered with third-party developers like Lookout Mobile Security and Assurion to either load tracking and protection apps directly on the handset, or to make them available for download. The apps are similar to Android Device Manager and Find My iPhone, though you'll need to purchase monthly insurance programs to use them.
Verizon Wireless does things bit differently by offering its own branded app for controlling a handset once it's gone. Like with Big Red's carrier rivals, you'll need to subscribe to Verizon's Total Mobile Protection insurance program ($10 per month).

Verizon's security app has far more features for Android users.

The free app is available for both iOS and Android users (download it from the iOS app store or Google Play), but Android users get far more options. They'll be able to locate their handset on a map, sound an alarm, lock it, or wipe it completely. On the other hand, iOS users can only see their iPhone's last known location. As such, if you have an iPhone and are on Verizon, stick with Find My iPhone. It's free and has more features.
U.S. Cellular has its own app which is part of the carrier's Mobile Data Security Plan ($2.99 per month). Features include remote locate, wipe, and lock, and it's compatible with a long list of devices. MetroPCS's MetroGuard app is comparable, but costs $1 per month.

A national blacklist

As mentioned, individual carrier blacklists only go so far. If a thief unlocks an AT&T phone (or the handset is unlocked to begin with), for example, the IMEI of that device wouldn't be on record with T-Mobile. The CTIA, the wireless industry's lobbying group in Washington, D.C., worked with carriers to set up a nationwide blacklist that went into effect in October 2012, but it was limited to phones that used 3G networks (both CDMA and GSM). Granted, a thief probably won't bother stealing a non-3G phone, but you can't argue that the list was fully comprehensive.

Jamie Hastings

Fortunately, that list will be expanded to include all LTE devices by November 30, but even then some gaps will remain. First off, it won't include phones that don't have LTE. While that's a fast dwindling group, it doesn't include the iPhone 4, 4S, or the LG Nexus 4, among others. Also, though the CTIA says that 92 percent of US carriers are supporting the list, it won't cover prepaid customers regardless of carrier. Now, that's not a huge number either, but as the industry moves away form the traditional contract model, the number of prepaid customers will grow.
A more pressing issue, however, is that a US-centric list does nothing to stop phones from being reactivated in other countries. Or as New York Attorney General Eric Schneiderman put it, "This is an international problem that demands an international solution."
The CTIA says that it supports an international list, but it stopped short of recommending a detailed plan for getting there. "We also need more countries and carriers to participate in the database so that when criminals try to sell them internationally, the stolen devices would be blacklisted and would not reactivate," said Jamie Hastings, the CTIA's vice president for external and state affairs, in a statement to CNET.

Is a Kill Switch the answer?

The CTIA is not, however, signing on to the idea of a "kill switch" that some law enforcement officials support. Though San Francisco District Attorney George Gascón has not advocated for a specific technology or solution, he wants carriers to use a kill switch to remotely deactivate all features of a phone (possibly via a text message) and render it completely useless.
"The solutions we're demanding will eliminate the value of stolen devices on the secondary market," Gascón said in a statement to CNET. "We commonly refer to this technology as a kill switch, since it 'bricks' the central features of the phone, making its value equivalent to that of a paper weight. We know this technology exists."
Essentially, that's pretty much what Apple's Activation Lock already does. But Gascón wants carriers and manufacturers to put it on all phones and be more vocal about encouraging customers to use it.
"The only way thieves will stop robbing people for their devices is if they know there's no payoff," he said. "That's going to require a comprehensive deterrent that renders stolen devices useless."

George Gascon

But that's not how the CTIA sees it. Though the organization would not provide CNET with a spokesperson to talk about the issue, it said via a position paper that a kill switch carries too many risks. For example, because the customer information and the related technology would be shared by multiple parties such as carriers and OS developers, there would be no way to keep it secret. As a result, anyone from terrorists to amateur hackers, to vengeful lovers and employees could steal and misuse the technology. What's more, if a customer happened to recover their device after using the kill switch, they wouldn't be able to use it again.
"Where mobile devices are permanently disabled by malicious use of a 'kill switch,' the safety of subscribers may be jeopardized as they will be unable to make emergency calls," the paper said. "Even if technically feasible to develop, a permanent kill switch has very serious risks."
Those are valid risks, but they may not be the whole story. In a CBS News story posted this morning, Gascón said that a kill switch would eat into the revenue that carriers make from customer insurance plans. Also today, the New York Times reported that carriers prevented Samsung from installing kill switch-like technology in its smartphones.
As an alternative, the CTIA would support the Mobile Device Theft Deterrence Act of 2013 (S.1070). Introduced by Sen. Charles Schumer (D-NY), the legislation would impose a five-year criminal penalty for tampering with the IMEI or ESN of a cell phone. Changing the IMEI or ESN, which would a allow a stolen phone to be reused, is a loophole that skilled thieves have begun to exploit.
"We strongly support and need Sen. Schumer's legislation to pass that would impose tough penalties on those who steal devices or modify them illegally since it would help dry up the market for those who traffic in stolen devices," said CTIA's Hastings. As of last May, though, the bill is still in the House Judiciary Committee and has not come up for a vote.

More could be done

If cell phone theft continues to grow, and (heaven forbid) becomes more violent, then perhaps the industry will be open to more solutions like a better blacklist. No industry, though, loves government regulation, so the chances of more happening are slim. The CTIA in particular, will do what it can to stop anything resembling a kill switch. So, for now, smartphone users need to take care when using their devices in public, and take every available measure for securing and remotely managing their devices. And, if Google and Microsoft can develop comprehensive features like Activation Lock, then that will be even better. Because at least then, your phone may be gone, but you'll have the satisfaction of knowing that anyone else will have a hell of a time trying to use it.

NSA tracks Google ads to find Tor users

The Tor Browser anonymizes your IP address, and has been the subject of intense scrutiny by the NSA.

(Credit: Tor Project)

Just because the National Security Agency hasn't cracked the anonymizing service Tor doesn't mean that people who use the service are free from surveillance.
The NSA has been able to use ad networks like Google's, and The Onion Router's own entry and exit nodes on the Internet, to follow some Tor users, according to a new report based on documents leaked by whistleblower Edward Snowden and obtained by security researcher Bruce Schneier with the Guardian. Tor is primarily funded by the US State Department and the Department of Defense, home of the NSA.

Tor promotes itself as helping people "defend against traffic analysis, a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security."
Robert Hansen, a browser specialist at the security firm White Hat Security, said that Tor access node tracking is not new.
"A couple of years ago a hacking group published exactly 100 embassy passwords from Tor exit nodes. One hundred is too round of a number," he said. "Just logically there must be more. If you get enough exit nodes and entrance nodes, they can be correlated together."
Director of National Intelligence James Clapper criticized reporters and denied that his office was doing anything illegal, citing the threat of "adversaries."

The articles fail to mention that the Intelligence Community is only interested in communication related to valid foreign intelligence and counterintelligence purposes and that we operate within a strict legal framework that prohibits accessing information related to the innocent online activities of US citizens.

The system that the NSA uses to locate and identify Tor users begins, at least sometimes, with the buying of ads on networks like Google's AdSense.

"The very feature that makes Tor a powerful anonymity service, and the fact that all Tor users look alike on the Internet, makes it easy to differentiate Tor users from other Web users," he wrote.
The NSA buys ads from ad display companies like Google and seeds them around Tor's access points.

 

 

"The NSA then cookies that ad, so that every time you go to a site, the cookie identifies you. Even though your IP address changed [because of Tor], the cookies gave you away," he said.
This is not some complicated or even an unusual trick, Grossman said. It's how tracking ads were intended to function.
"That's the Web by design, not a hack," he said.
The NSA, he said, is not spending much money on it since Internet ads are so cheap. Grossman speculated that an ad campaign would only cost around $1,000 to seed ads with the NSA's cookies around the Web.
"$50,000 would be overkill," he said.
Because the NSA is essentially using how the Web functions to spy on its users, tools like Tortilla that take the burden of Tor usage away from Firefox wouldn't prevent the NSA's tracking ads from finding people.
It wouldn't be feasible for Google to block ad buys from the NSA, and if the company did, he said, "they could just buy through a proxy."
Google did not respond to a request for comment.
Both Tor itself and Schneier noted that the NSA has not been able to track every Tor user this way. "They are hard for any organization other than the NSA to reliably execute, because they require the attacker to have a privileged position on the Internet backbone," Schneier said.
Grossman speculated that the NSA could be using spam e-mail campaigns as it's been using display ads, though he cautioned that he didn't have evidence that this was actually happening.
"On the off chance that [the spam recipient] renders the HTML or clicks a link, [the NSA] can connect your e-mail address to your browser," he explained, which the NSA would have already connected to an IP address. "Using Tor or any proxy wouldn't prevent it."
Not all Tor installations are created equal, added Hansen, who has an unusual pedigree in the browser vulnerability field because he's also a veteran of the ValueClick ad network, which was later bought by DoubleClick, which subsequently was purchased by Google.
"It depends on whether you're using Tor Button or Tor Browser," he said. "The Tor Button tends to be more secure because as you jump in and out of the Tor Browser, it tracks cache and cookies."
However, since the Tor Project now includes a patched version of Firefox, it recommends not using the Tor Button and only using the standard Tor Browser Bundle instead.
More secure than either, Hansen said, was to run Tor on a virtual machine so that cookies and cache are dumped when the machine is closed, and the kind of man-in-the-middle and man-on-the-side attacks described by Schneier are avoided.
"If you don't take the critical steps to protect your privacy, you will be de-cloaked if you're doing something interesting," Hansen said.

US charges 5 more in $45M global cybercrime scheme

 

 

Five more people have been arrested in connection with a global cybercrime ring blamed for the theft of $45 million from banks around the world in a matter of hours.
The five men join eight other men who were indicted in May with participating in a scheme to rob thousands of ATMs using bogus magnetic strip cards. One of those original named defendants -- believed to be the ringleader of the cell -- was murdered in the Dominican Republic in April.
Using data stolen during hacks into two credit card processors, the ring made more than 40,500 withdrawals in 27 countries during two sprees in December and February, prosecutors said. The defendants eliminated the withdrawal limits from accounts during the intrusions and then fanned out across multiple cities with old hotel keys or expired credit cards encoded with the correct account information and access codes to quickly drain ATMs.

Surveillance cameras showed one of the original defendants allegedly moving from ATM to ATM, his backpack growing increasingly loaded with cash. Others photographed themselves with wads of cash as they roamed Manhattan streets, prosecutors said.
On Monday, authorities charged Anthony Diaz, 24, Saul Franjul, 23, Saul Genao, 24, Jaindhi Polanco, 29, and Jose Angeley Valerio, 25, with conspiracy to commit access device fraud. Prosecutors said they have photographic evidence that the men, all from the Yonkers section of New York, transported $800,000 in cash proceeds from the heist to the now-deceased ringleader, who was then in Florida.
"As alleged, just a few months ago, after exploiting cyber-weaknesses in the financial system to steal millions from ATMs, these defendants were packing bags to the brim with stolen cash, destined for the cybercriminal organizers of these attacks," US Attorney Loretta E. Lynch for the Eastern District of New York said in a statement. "Today, we have sent them packing once again - but this time, to jail. We will not relent until all those responsible for these financially devastating cybercrimes are brought to justice."
A sixth defendant named in the indictment, Franklyn Ferreira, is currently a fugitive from justice, prosecutors said. The new defendants face up to 7 and a half years in prison, as well as forfeiture and fines of up to $250,000 if convicted.

Adobe hacked, 3 million accounts compromised

Adobe announced on Thursday that it has been the target of a major security breach in which sensitive and personal data about millions of its customers have been put at risk.
Brad Arkin, senior director of security for Adobe products and services, explained in a blog post that the attack concerns both customer information and illegal access to source codes for "numerous Adobe products."
A few examples include Adobe Acrobat, ColdFusion, and the ColdFusion Builder. However, as far as the source code is concerned, Adobe assured that there is no "increased risk to customers as a result of this incident."
Adobe officials added that the investigation has not turned up any zero-day attacks either.
Unfortunately, the culprits have obtained access to a large swath of Adobe customer IDs and encrypted passwords.
Arkin specified that removed sensitive information (i.e. names, encrypted credit or debit card numbers, expiration dates, etc.) about approximately 2.9 million Adobe customers.

He added that investigators don't "believe the attackers removed decrypted credit or debit card numbers" from Adobe's systems.
While federal law officials are involved, Adobe stressed that there are some precautions that customers need to take action on now.
Adobe is resetting the passwords on breached Adobe customer IDs, and users will receive an email if they are affected. The software giant is also currently notifying customers whose credit or debit card information was exposed.
Adobe has also promised to offer these customers with the option of enrolling in a one-year complimentary credit monitoring membership where available.
This story originally appeared as "Adobe admits 2.9M customer accounts have been compromised" on ZDNet.

Easy access to Airplane mode an iOS 7 security flaw -- researchers

 

 

Apple's Control Center in iOS 7 makes it easier to access certain functions, but a recently released study from security researchers suggests it might be causing harm.
Security researchers at German firm SR Labs posted a video to YouTube recently showing how the easy access to Airplane Mode in Apple's Control Center could give hackers the extra time they need to exploit a device.
Here's how the scenario could play out: a hacker steals an iPhone running iOS 7. As soon as they get their hands on the locked device, they open Control Center from the lock screen and turn on Airplane Mode. From there, they set out to break into the device and change Apple ID passwords to prevent the owner from accessing the device.

The turning on of Airplane Mode is the important function in this scenario. Having easy access to Airplane Mode in iOS 7 effectively takes the device offline, eliminating the owner's ability to find out where the iOS device is and remotely wipe it. That provides hackers with the time they need to break into the device.
In iOS 6, Airplane Mode was available only after getting through the lock screen and there was no Control Center, meaning hackers couldn't take advantage of the hack in previous installations.
In addition, the researchers warned that Apple's Touch ID fingerprint sensor could allow for new attacks. In an interview with CNET sister site ZDNet, they indicated that creating a spoofed fingerprint to open the handset is as simple as snapping an image of a latent fingerprint with another device and using some equipment to complete the job. The researchers claim the fingerprint spoofing will only take one hour to complete.

Creepy Google Glass pics without anyone knowing? Yes, you can

So clever

I have come to terms with the notion that we will all soon be wearing glasses in order to surf the Web, check messages, and pretend we work at Google.
Some, though, are still concerned that the glasses offer too much opportunity to photograph or film people surreptitiously.
Defenders of the Google faith point out that no, no, you can tell when the glasses are in use. There's a light that beams to the world.
A twisted few find this unfortunate. They want to be cleverer than thou and more creepy than thou.
May I present, therefore, the very fine Google Glass 3D Printed Sunshade
This is the invention of Chris Barrett, a PR man who has made some hay by being a Google Glass explorer and, well, exploring the boundaries of life and taste.
It was he who was first to film an arrest using his new glasses.
It was also Barrett who wandered into an Atlantic City casino beglassed. And, in what seemed then as the apogee of Glassing fame, Bon Jovi's keyboard player even wore Barrett's goggles during a show.
Barrett, though, was having personal issues with his eyepiece. He told me that he was having trouble seeing the graphics when it was sunny.
So he got together with Next Fab Studio. Together, they created the 3D Printed Sunshade.
You see, he'd tried wearing a hat, but that didn't really work. With the Sunshade, he's happy, as will be those who can download the open-source code.

Also in their happy place will be those who are slightly less honorable than Barrett.
One aspect of the Sunshade is that it obscures the light that tells you Google Glass is in use. You are now free as a bird to shoot whatever you like, whenever you like, and from whatever angle you can get your head around.
Accused of encouraging sneakiness, Barrett repeated that his only motivation had been poor visibility during sunny days. He told me: "I did not create the Sunshade to be sneaky. The 3D printed Sunshade does make Glass less noticeable. Less people ask me what I'm wearing when they can't see the prism light up."
Every new technology creates aspects that the good-hearted wish didn't exist. Sometimes, though, I wonder whether the good-hearted are so enamored of the technology that they choose to enjoy a little denial.
Barrett insisted: "With any new technology like Glass or a wearable watch with a camera, it's up to the user to decide how and when he or she will use the camera to record video or take photographs."
Of course he's right. Google Glass is not a cheeseparing invention. But Barrett's Sunshade has now given a eyeful of glee to those whose core interests might upset many.
Will someone now invent the equivalent of a missile shield defense that prevents you from being photographed when, say, you're out on the street?
Where's that invisibility cloak when we need it?

Apple's bid to ban Samsung products may be back in play

 

Apple's request to ban certain Samsung products amid last year's patent court battle might be back on the table.

A federal appeals court said on Monday that U.S. District Judge Lucy Koh erred when she denied Apple's request to ban 26 Samsung products found to have violated Apple patents, The Wall Street Journal reported. The appeals court agreed with part of Koh's ruling but said she should review the evidence given by Apple and reconsider her decision to deny Apple's request for a product ban.
In August 2012, a jury found Samsung guilty of patent infringement, resulting in an award of $1.05 billion in damages. However, Koh agreed with Samsung's argument that the damages were sufficient penalty and that a product ban was not warranted.
In March, Koh vacated $450 million of the original damages, meaning Samsung will have to pay at least $600 million in damages. But a new jury is currently trying to decide how much more Samsung should have to pay. Apple wants $380 million, however, a Samsung expert said on Friday that the amount should be only $52 million.

Google Play Music makes its debut in Apple's App Store

The application allows people to listen to the millions of songs in its library, as well as upload up to 20,000 of the user's own songs to the service for access elsewhere.
 
Google Play Music for iOS.

The mobile music war just hit a higher note.
Google on Friday launched its long-awaited Google Play Music application for Apple's iOS. The free application, which is available now in the Apple App Store, allows users to stream millions of songs and create custom radio stations. Unlike Apple's iTunes Radio and Pandora, there are no skip limits on Google Music.
Those who want to listen to their own libraries also can upload up to 20,000 of their own songs to Google's music cloud service and access those on other devices.
Google announced the Play Music app in May. At that time, the company promised it would be made available over the summer.
Despite missing that mark, Google has come through with other promises it made in May. The app's streaming function, Google Music All Access, includes the ability to download tracks locally for listening when away from a wireless signal. Google also has offered a 30-day free trial on All Access. After that period is up, customers will pay $10 per month for access to the streaming service.

Apple, Samsung rest cases ahead of final arguments Tuesday

Samsung and Apple are duking it out in court over damages for Samsung's patent infringement. 

SAN JOSE, Calif. -- Apple and Samsung on Monday wrapped up the testimony in a damages retrial, setting up their positions for their last pitches to the jury.
Judge Lucy Koh allowed each side eight hours of testimony. Samsung rested its case Monday with two minutes left. Apple had 16 minutes left. They'll each have 90 minutes to make their closing arguments Tuesday morning. The case will then be handed over to a jury of six women and two men.
The two companies spent their final hours and minutes Monday grilling expert witnesses on how much money Samsung owes Apple for patent infringement. Apple says Samsung owes it $380 million for the infringement. Samsung says it should pay only $52 million.

A retrial in the United States District Court for the Northern District of California kicked off last week to determine what damages Samsung owes Apple for infringing on five of its patents. A judge in March vacated about $450 million of an original award and ordered a new jury to convene to recalculate the damages. Samsung is still on the hook for about $600 million, no matter what happens in the retrial. For most, the damages retrial was a case of Groundhog Day. No new revelations emerged during the testimony, and most witnesses also took the stand during the last trial more than a year ago. Apple's witnesses argued Samsung's copycat devices hurt the company, while Samsung argued that people seek out its devices more for their differences than similarities to Apple gadgets.
During closing arguments Tuesday, Apple will detail why it deserves nearly $400 million. A big part of the discrepancy between what Apple wants and what Samsung thinks it should pay comes from differing views on how much Apple lost in profits and how much it should be due for royalties. The two sides also disagree on how much money Samsung made from its copycat products.
Samsung will argue the company's profit totaled much less than Apple says because of expenses such as advertising. Apple's expert did not include those operating costs in her tally.
Apple says it deserves such a high amount because users would have bought more of its gadgets if Samsung's devices weren't on the market. It acknowledged that it often has supply shortages but took pains to show it could meet slightly higher demand. And at the time Apple created the iPhone, such a product was a huge risk, it says.
The companies' experts also disagree on how much Apple deserves in reasonable royalties. Samsung, for its part, argues that Apple doesn't deserve any royalties because its patents have limitations. Its expert, Michael Wagner, said Friday that there's no evidence anyone buys Samsung's gadgets for Apple's patented touch-screen features.
Not at issue in this case is whether Samsung infringed Apple's patents. The judge will instruct the jury that a previous jury already decided Samsung infringed, and that they shouldn't revisit that issue. The sole consideration in the retrial is money -- just how much Samsung owes Apple for infringing its patents.
Apple arrived at the $380 million amount based on lost profits of about $114 million, Samsung's profits of about $231 million, and reasonable royalties of approximately $35 million. Apple estimates it would have sold 360,000 devices if Samsung hadn't released infringing rivals.
Samsung, meanwhile, said Apple shouldn't receive any money for lost profits, $52.7 million for Samsung's profits, and royalties of only $28,452 because the patents have limitations.
Apple originally filed suit against Samsung in April 2011, accusing the Korean company of copying the look and feel of its products. Samsung countersued two months later over patent infringement and said it was at work on touch-screen phones with giant rectangular screens and rounded corners well before Apple showed up. The initial trial, which stretched more than three weeks in August 2012, wrapped both of those cases in one, somehow squeezing together the patent infringement issues, alongside antitrust claims, and even trade dress issues.