Kaspersky

Kaspersky Lab uncovers a suite of surveillance platforms that hide in hard drive firmware

Security researchers at Kaspersky Lab have unearthed a suite of surveillance platforms that can hide within the firmware of hard drives from more than a dozen manufacturers. The attackers, which Kaspersky is calling the Equation Group due to their complex skill set, are the most advanced that the researchers have encountered to date.

The programs, some of which date back to 2001, appear to have been developed in succession with each new program being more sophisticated than the last according to Wired.

Personal computers in more than 30 different countries have been discovered to carry the infection, Kaspersky said.

One of the worms uncovered has direct connections with Stuxnet and may have even been used as a test to help figure out the best route for the malware to reach systems involved in Iran’s nuclear program. Researchers didn’t name who they believe might be behind the attacks although there’s a good bit of circumstantial evidence that points to the NSA.

One component of the suite, GrayFish, is able to reflash the firmware on hard drives. Because it resides in the firmware, reformatting the drive doesn’t get rid of the infection. Key to being able to rewrite the firmware is having access to source code. If the NSA is indeed behind the attacks, getting source code wouldn’t present too much of an issue.

In addition to physically intercepting shipments (in this case, hard drives) and loading them with malware before repackaging and sending to targets, the NSA could have simply asked manufacturers for their source code (directly or indirectly) or posed as software developers.

Lenovo website hacked

Lenovo website apparently hacked by Lizard Squad because of Superfish incident

Things took a turn from bad to worse from Lenovo this week. After the embarrassment that was Superfish last week, the Chinese computer maker’s website recently fell victim to hackers.

For a brief period on Tuesday afternoon, those visiting lenovo.com in search of a new computer or drivers were instead met with a bizarre series of photos of teens set to the pop song Breaking Free from High School Musical. As of writing, the site is offline due to "system maintenance."

The source code of the hacked page references it as the new and improved rebranded Lenovo website featuring Ryan King and Rory Andrew Godfrey. These two individuals have previously been ousted as members of Lizard Squad.

Clicking on the slideshow would take visitors to Lizard Squad’s Twitter account.

By all accounts, this appeared to be a DNS hijacking that granted attackers the ability to redirect traffic from lenovo.com to a server under their control. A visit to the squad’s Twitter account, however, suggests they may have somehow gained access to some of the company’s e-mail accounts / e-mails.

In one screenshot of an e-mail, we learn that removal of the Superfish software on one customer’s computer resulted in a bricked device.

Speaking of, it’s likely that this hacking incident is in direct relation to Superfish – a piece of adware that Lenovo had been secretly adding to machines. After getting caught red-handed last week, the company released a removal tool and vowed to never use it again.

YouTube

HTML5 replaces Flash as default player on YouTube

HTML5 is now the default setting for video playback on YouTube when using Chrome, IE 11, Safari 8 and beta versions of Firefox. If you needed any more evidence to support the claim that Flash is dead, it doesn’t get much more damning than this.

YouTube has actually supported HTML5 for years, having first introduced support for the standard way back in 2010. Of course, it was extremely limited at that time and lacked support for several key features like adaptive bitrate (ABR).

This feature, one of many now supported by HTML5, helps reduce buffering and enables livestreaming on game consoles, devices like Chromecast and in web browsers.

HTML5 also lets users take advantage of the VP9 codec which YouTube used to showcase 4K streaming video at CES 2014. This codec from Google reduces bandwidth by 35 percent, allowing for wider access to 4K and HD at 60FPS videos. Videos also start anywhere between 15 to 80 percent faster according to YouTube engineering manager Richard Leider.

Last but not least, a bit of advice for those that embed video. YouTube is deprecating the “old style” of Flash < object > embeds and is instead encouraging all embedders to use the < iframe > API as this method will use whichever technology is best suited for the client.

Up to this point, Adobe Flash was the default for videos on YouTube. If you wanted to use HTML5 on the site, you had to go manually enable it.

WhatsApp

WhatsApp adds two new browsers to its web client messaging

About a month ago WhatsApp announced that its 700 million users will be able to access the popular messaging service through a new web browser client. Since then the company began rolling out voice calling features, but has now returned its focus to the browser adding a few new options for its massive user base.

While previously limited to Google’s Chrome web surfer, WhatsApp has now added support for both FireFox and Opera. Much like the Chrome set-up process, users will simply need to navigate to the web client and scan a QR code in order to connect the browser app with their mobile WhatsApp account. As we previously reported, because all your conversations on the web client will be kept on your mobile device, your phone will need to remain connected during your browser calls.

As you might know, WhatsApp uses no passwords or user names and instead relies on a user’s mobile phone number for identification. Due to the QR requirements and what WhatsApp describes as iOS limitations, this service is only available for those with Android, Windows Phone and BlackBerry devices at this point.

While Safari and iOS users appear to be still left out in the cold as we previously explained, WhatsApp did say publicly that an iOS compatible client was on its

Ubuntu smartphone

First Ubuntu smartphone goes on sale next week

It’s been several years in the making but the first Ubuntu-powered smartphone is nearly upon us. The BQ Aquaris E4.5 Ubuntu Edition will finally go on sale starting next week although it’s not the same handset that was promised a few years ago.

Canonical, the group behind the Ubuntu Linux distribution, launched a crowdfunding campaign in the summer of 2013. The campaign aimed to raise an astronomical $32 million to fund the creation of what would have been a top-tier smartphone running the Ubuntu operating system, the Ubuntu Edge.

While Canonical managed to raise a record $12.8 million, it fell far from the initial goal.

The group’s intentions to launch an Ubuntu-powered handset never wavered, however, which is how we got to the BQ Aquaris E4.5 Ubuntu Edition.

The handset is actually a BQ Aquaris E4.5 that’s been loaded with Ubuntu. This mid-range phone features a modest 4.5-inch display with a resolution of 540 x 960 and is powered by a quad-core MediaTek Cortex-A7 SoC clocked at 1.3GHz. There’s also 1GB of RAM, 8GB of internal storage and an 8-megapixel rear-facing camera.

Canonical is pricing the phone at just €169.90 ($195), far cheaper than the $695 that the Ubuntu Edge would have set buyers back. It’ll be offered initially through a fire sale next week with a handful of European carriers.

Canonical is still working on its US device strategy but as of writing, there’s no timeline for a launch outside of Europe.

Google domain

Google domain registration services now available to all in the US

If you want to register a domain but would rather not use a service like GoDaddy, Google has just opened up their domain registration services to everyone in the United States via a public beta. Previously, the service was only available to a select group of testers via a closed beta, which launched in June last year.

Pricing is fairly typical, starting at $12 per month. Google will provide you with the domain name alongside private registration, support for up to 100 subdomains, domain forwarding and email forwarding to Gmail.

Google has teamed up with a number of companies to help you create websites using your newly acquired domain, including popular website builders and hosts Squarespace, Weebly and Wix. Using these services will cost extra, but will make it easy for you to build a website from the ground up. Blogger is also supported, allowing you to link a new domain and an existing blog with ease.

During the closed beta, Google collected a bunch of useful information that allowed them to improve the service for all users. Search and suggestion services have been tweaked, 60 new domain endings have been added, the dashboard has been simplified, and there's now the ability to browse website template themes and compare the aforementioned building services.

Google domain registration services are only available for those in the United States at this stage. If you're in another country and interested in using Google Domains, you can sign up to receive a notification for when it's ready in your area.

Firefox

Firefox 35 includes streamlined Hello video chat, MP4 support on Mac, easier social network sharing

Version 35 of Mozilla’s Firefox web browser is now available for download. Arriving roughly five weeks after its predecessor, the latest iteration includes a handful of noteworthy features in addition to the usual gamut of minor updates and behind-the-scenes fixes.

Firefox Hello, Mozilla’s WebRTC-based real-time video and audio calling service, has been streamlined a bit. Previously, users had to simply wait idly for the person on the other end to connect to the call. In Firefox 35, a small window opens showing a self view until the invited person joins and in the meantime, the caller can perform other tasks like surfing the web

.

It’s a small change but any way to add productivity is welcomed in my book.

Another time-saver is the ability to create multiple conversations and save them for later use which makes it easier to reconnect with people you talk to on a regular basis without having to create a new link each time. All of this can be done without having to create an account or forfeit any user information.

Elsewhere, Firefox 35 enables desktop users to access the Firefox Marketplace, built-in support for MP4 playback on Mac OS X (Snow Leopard and newer) and makes it easier to share web content on social networks like Facebook, Twitter, Tumblr, LinkedIn and Google+. Mozilla has also fixed nine security-related issues in the new release according to its securities advisories page.

Firefox 35 is available for Windows, Mac and Linux.

Google Translate

Google Translate updated with Word Lens integration, improved real-time conversation translation

Confirming reports that emerged earlier this week, Google has updated its Translate app for both Android and iOS, bringing features such as instant translation with Word Lens and improved real-time conversation translation.

The updated app has made it even easier to navigate a foreign language by letting you instantly translate text using your camera. All you have to do is to just point your camera at a sign or text and you’ll see the translated text overlaid on your screen.

This instant translation should come in handy while navigating foreign-language street signs, or deciding what to order off a restaurant menu in a different language. The best part is that it works even if you don't have an Internet or data connection.

The feature currently works for translation from English to and from French, German, Italian, Portuguese, Russian and Spanish, although the company is working to add more languages.

Aside from this, Google has also tweaked the real-time conversation translation feature to make the conversation flow faster and more naturally. "When talking with someone in an unfamiliar language, conversations can... get... realllllllly... sloowwww," the Mountain View, California-based company said in a blog post.

Simply tap the mic to start speaking in a selected language, then tap the mic again, and the app will automatically recognize the language being spoken. You just have to do this once for each speaker, which means that for the rest of the conversation, you won’t need to tap the mic again.

Head over to Google Play or the App Store to download the latest version of the app. The update is gradually rolling out so it may take a few days before it reaches everyone.