LightBlog

vendredi 12 mai 2017

New Security Research Reveals All OnePlus Devices are Vulnerable to Downgrade Attacks

Back on January 26, 2017, Aleph Research notified OnePlus about four different vulnerabilities that they felt needed to be patched. Two of these have been marked as critical (CVE-2017-5948 & CVE-2017-8850) while the other two had their severity marked as high (CVE-2017-8851 & CVE-2016-10370). The team reported these to OnePlus in a responsible manner and with that came a 90-day disclosure deadline. Aleph Research went as far as to even extend this by 14 days, but they are still left unpatched.

The vulnerabilities in question are possible on at least one of every smartphone OnePlus has produced. So, if you have the OnePlus One, OnePlus 2, OnePlus 3, OnePlus 3T or the OnePlus X, then your device is vulnerable to at least one of these attacks. This assumes you are running either OxygenOS or HydrogenOS though, which are the two firmwares that OnePlus is responsible for. The attack targets weaknesses in how the phones accept OTA updates.

This is possible via a man-in-the-middle attack, or simply when sideloading an OTA update via recovery. However, it should be noted that the OnePlus 3 and OnePlus 3T are not vulnerable to this sideload attack vector assuming Secure Start-up is enabled (Full Disk Encryption (FDE) with user credentials). These vulnerabilities enable the attacker to downgrade your version of OxygenOS or HydrogenOS. So no matter what new security patches your OnePlus device has, the software can be easily downgraded (without a factory reset) and then exploited via an old vulnerability.

There’s even the issue of the OnePlus X software actually being able to be installed on the OnePlus One in this way, and the OnePlus One software being installed on the OnePlus X. Both of these instances lead to a Denial of Service (DoS) and results in a bootloop until a factory reset is done. We hope that these issues disclosed by Aleph Research are promptly patched now that the research team has publicized their work.


Source: Aleph Research



from xda-developers http://ift.tt/2pGXqka
via IFTTT

.

Moto G5 Plus Toolkit Helps you Unlock the Bootloader, Root your Phone, and Make Backups

Although some users are comfortable using the command line to unlock their bootloader, many users would prefer having a nice GUI to guide them through everything. To that end, XDA Junior Member drtechie created an open-source, multi-platform toolkit that works on Windows, macOS, and GNU/Linux distributions. It helps you unlock your bootloader, root your phone, and flash TWRP. It can also perform TWRP backups and restore those backups at a later time.



from xda-developers http://ift.tt/2ptfNwX
via IFTTT

.

Lighthouse Intelligent Assistant Announced, Can Identify People And Pets while Away at Home

The market of intelligent assistance is rapidly growing. A new device has officially been announced to compete with the projects from Google, Amazon, and Microsoft. Lighthouse will use computer vision to detect and monitor activity within a home.

Intelligent assistants are an extremely popular topic in the past few weeks. Amazon released its Echo Show touchscreen speaker with Alexa on board. Microsoft has put a lot of effort to upgrade the Microsoft Bot Framework and the newly released Cortana Skills Kit. Lighthouse is another player that joins this race.

The company behind the project has also announced they’ve raised $17 million since founding. It was led by Eclipse Ventures with participation from Playground Ventures. At the company’s base is Andy Rubin’s incubator for startups called Playground Global. Andy Rubin is a former Google employee and a co-creator of Android who has run the incubator since 2015. It was invested in by Google, HP, Foxconn, Redpoint Ventures, Seagate Technology and others. The Lighthouse company has 30 employees.

The device was made by Alex Teichman and Hendrik Dahlkamp. The latter was an engineer at Google X and a winner of the DARPA Grand Challenge for autonomous vehicles. Both gentlemen met at Stanford University and worked on adopting 3D sensors and self-driving cars. The project has been actively developed since 2015.

Unlike Alexa or Cortana, Lighthouse is not a partner for friendly banter. It won’t tell jokes or play music. The device was designed to give insight to users when they are away from home. 3D sensors can identify people, pets, kids etc. For example, when a child enters the house, Lighthouse sends a message to the app. The device will recognize whether a family member enters the house or some unknown person. You can watch the promo video below.

The device offers voice communication so a user can send a voice message that will be played via speaker, a feature that many people have been asking to bring to Google Home since its release.

Users can order Lighthouse by paying annual installments. The first year costs $399, second $499 and third $599. Unhappy users can ask for a refund after a year of service.

Are you planning to get Lighthouse? Let us know in the comments!


Source: VentureBeat



from xda-developers http://ift.tt/2pGek1t
via IFTTT

.

Microsoft Demos Windows 10 on ARM Hardware Running Existing Win32 Apps

We’ve known that Microsoft has been dedicated to getting Windows 10 running the way it should be on ARM hardware. Back in December of last year, we were told that the next generation Qualcomm Snapdragon chips would officially support Windows 10. We weren’t given a solid date for when this type of hardware would be made available to consumers, but they did project it would happen in the second half of 2017. At the Microsoft Windows Hardware Engineering Community (WinHEC) event, they even went as far as to show this in action.

Now, it looks like Microsoft has made great strides in bringing full blown Windows 10 to ARM devices given how things are turned out at the recent Microsoft Build 2017 developer event. One session showed some new hardware and software running Universal Windows Platform apps, Win32 applications from the Windows Store, and even existing Win32 programs.

Along with showing off first-party applications such as Edge during the demo, Microsoft’s lead program manager Hari Pulapaka also downloaded, installed, and ran an x86 version of 7zip. This is possible thanks to an optimized emulation layer from within Windows 10. Since it is emulation, there will be some degradation when it comes to performance. However, Mr. Pulapaka states the company is aiming for and mostly achieved “very close to native” performance.

The emulation used to enable this to work so well is actually based off of the same Windows on Windows (WOW) layer that is used to run x86 apps on 64-bit processors. However, the real work under the hood is from the Compiled Hybrid Portable Executable files that are generated from ARM64 code. The goal from Microsoft and Qualcomm is to have this all working so seamless that most people will likely not even notice a difference in hardware.


Source: VentureBeat



from xda-developers http://ift.tt/2qAN49H
via IFTTT

.

Android Wear 2.0 on the Huawei Watch

In this new video from XDA TV, Eric takes a look at the Android Wear 2.0 update on his Huawei Watch. Android Wear 2.0 brought a lot of significant updates to smartwatches. With the update now being available on the Huawei Watch, this device might find its way back on to your wrist.

The new input feature in Android Wear 2.0 works surprisingly well, considering the small display.

Performance has seen a decent boost overall. This new found speed may have you going back to your old smartwatch, if you’ve abandoned it in the past.

A new app drawer animation is much faster than it was in Android Wear 1.0

A much needed “clear all” option has been added to the notification menu.



from xda-developers http://ift.tt/2qaEJIg
via IFTTT

.

How to Add Custom Buttons to the Nav Bar on the Samsung Galaxy S8/S8+

Samsung’s Galaxy S8 and Galaxy S8+ are two of the hottest smartphones on the market, largely thanks to the great strides Samsung made with their display technology. Since Samsung aimed to reduce bezels as much as possible with their new flagship devices, the company has finally gotten rid of the capacitive keys that were once staples of Samsung hardware. In its place are software navigation keys, which can be modified to some extent within the Samsung Experience UI.

As usual, however, the stock implementation of the nav bar tuner is quite lacking in its customizability. Most of the customization centers around the home button – you can change the sensitivity and whether or not it directly unlocks the phone. While there is an option to change the button layout, the only layout you can switch to is an inverted layout whereby the back and the recents key are flipped.

Galaxy S8, Galaxy S8+, nav bar Galaxy S8, Galaxy S8+, nav bar

We at XDA-Developers are always looking beyond what the manufacturer offers in order to find more ways to customize your phone. That’s why today we’re introducing a method to add additional buttons to the navigation bar on the Samsung Galaxy S8 and S8+.

If you’ve been following the XDA Portal (as you should be), you may have seen my post last month about how nav bar customization could be performed in Android 7.X devices without requiring System UI mods, custom ROMs, or root access of any kind. The method involves directly modifying the settings that are responsible for tuning the nav bar, even though the GUI to modify the nav bar has been hidden from the user. This is because the code that makes up the hidden nav bar tuner has been in the Android Open Source Project (AOSP) repositories since Android Nougat, but it wasn’t until Android O that Google exposed this activity under the System UI Tuner. However, so long as the software shipped on your device running Android Nougat did not remove the code behind the nav bar tuner entirely, it’s possible to use this feature without waiting.

Modifying the navigation bar involves sending shell commands either through ADB or an app that has been granted the WRITE_SECURE_SETTINGS permission. Due to the fact that messing with ADB is something many people are not familiar with, XDA Senior Member paphonb developed an app called Custom Navigation Bar to make everything easier for you.

As thousands of people began testing his app, many users on the Galaxy S8 and Galaxy S8+ began encountering frequent System UI crashes when attempting to use the app. We thus assumed that modifying the nav bar beyond Samsung’s implementation was impossible – but that assumption has since been found wrong. Here’s how to do just that.

Adding Custom Buttons to the Nav Bar on the Galaxy S8 or S8+

After some initial testing, we discovered that the same shell commands we were sending in my original tutorial also work on the Galaxy S8 and S8+, but with one major caveat. The original back, home, recent, and IME switcher keys MUST be present no matter what layout you use. If any one of these keys is missing, the System UI will begin to repeatedly crash. Furthermore, any key that you add to the nav bar will look a bit strange when the Samsung nav bar automatically changes colors to a white background, but I’m looking into ways around this minor inconvenience.

Anyways, let us dive in to the commands you’ll need to learn in order to modify the nav bar on your Samsung Galaxy device. The first thing you’ll need to do is to set up ADB on your machine.

Setting up ADB

First, download the ADB binary straight from Google for your particular OS and extract it to a separate directory on your computer. Next, install the proper driver for your Samsung phone. Then, enable “USB Debugging” in Settings –> Developer Options. If you don’t see Developer Options, then you will need to enable it by going to Settings –> About Phone then tapping on Build number 7 times. Finally, ensure that ADB is working by starting a command prompt in the same directory as the ADB binary (hold shift + right-click –> “open command prompt here”) and run the following command:

adb devices

If you see your device’s serial number (and it doesn’t say unauthorized), you’re golden. If you see a pop-up on your phone asking you to grant your computer ADB access, then say yes. If you don’t see either happen, then try rebooting your computer/phone and re-plugging it into your computer. Otherwise, try re-installing the driver.

Modifying the Nav Bar – ADB Method

The syntax to modify the navigation bar is as follows:

settings put secure sysui_nav_bar "key(KEYCODE_CONSTANT:file:///path/to/icon.png),back;home;recent,menu_ime"

where KEYCODE_CONSTANT refers to the constant of a KeyEvent and the icon path is the file URI that allows you to specify a custom icon to add to the nav bar. I’ve found that 64×64 size icons work pretty well for our purposes. You can download many free icons from the IconsDB website.

As an example, the command I sent to add a nav bar key that launches the Gmail app is this:

settings put secure sysui_nav_bar "key(65:file:///storage/emulated/0/NavIcons/gmail.png),back;home;recent,menu_ime"

Since we absolutely have to have back, home, recent, and menu_ime somewhere in the command, that means we unfortunately cannot replace these stock keys so we can use our own custom nav bar icons. But at the very least, we can play around with the spacing to be able to fit more custom keys in or to just get the layout we would prefer. For instance:

settings put secure sysui_nav_bar "space[#],back[#];home[#];recent[#],menu_ime[#]"

The value in brackets is a relative size multiplier, allowing you to shrink or expand the button width. Note that typical values for the relative size multiplier should remain between 0.85-1.15, otherwise buttons will start taking up way too little or too much width to really be usable. Don’t try to put “0” for the relative size in an effort to hide the nav bar key – you’ll just end up crashing the System UI.

In case you mess with something and end up with System UI crashes, you can return to the default layout of the nav bar by entering either of the following two commands:

settings put secure sysui_nav_bar "space,back;home;recent,menu_ime"
settings delete secure sysui_nav_bar

As a reminder of some of the crazy things you can do with the hidden Android Nougat nav bar tuner, here’s a screenshot of a nav bar layout one of our readers made for giggles.

Has science gone too far? Credits: AndyYan

Modifying the Nav Bar – App Method

I’m sure this is the part most of you are really interested in. XDA Senior Member paphonb‘s Custom Navigation Bar app would make all of this easier. The developer recently figured out how to intercept certain KeyEvents that call certain apps – there are up to 5 KeyEvents that he figured out how to intercept in total. The exact explanation of how he got this working is not necessary here, so we won’t go into more detail. With that in mind, the developer was able to update the app (starting with version 0.5.0) so that you can essentially perform whatever action you please.

For instance, the developer recently added the ability to add an action that pulls down the status bar, directly launch an app of your choosing, and most importantly to trigger a Tasker event. The Tasker event feature in particular is the most amazing part, because through Tasker the amount of actions you can perform is limitless. If you want your nav bar button to do something, it can do it. Couple this with the already existing Tasker Profile integration, and you can contextually modify the nav bar on your device to add certain keys only under conditions of your choosing.

In order to use these special features of the app, you will have to dish out $1.99 to upgrade to the pro version of the app. At this time, to use the app on your Samsung Galaxy S8/S8+, you need to be on the latest beta version (0.7.0). The app will automatically detect if you’re using a Galaxy S8/S8+ and disable some features that will cause your device to start crashing.

I have been told by the developer that he is still working on getting the app ready for stable release for users on these Samsung phones. Right now, I would wait a few days for the developer to update his app so you’ll have an easy way to modify the nav bar without having to use ADB commands. The developer is quick to update his app – since the app was released less than a month ago it has already seen numerous feature additions.


Conclusion

If you’re adventurous enough though, you can play around with the hidden nav bar tuner already by using the syntax I’ve shown earlier. Most people will likely wait for the Custom Navigation Bar app to be updated – I just wanted to get this news out there so all of our Galaxy S8/S8+ friends will know what to expect. I will continue to post tutorials related to the nav bar tuner, with my next one focusing on how to add double/trick clicks to the nav bar buttons.

Please support XDA-Developers in whatever way you can! We recently discovered that there were several blogs cut, copy, pasting our original tutorials and other content shared by our users on the forums. These blogs have been trying to take credit for the huge amount of effort we do in compiling these tutorials rather than providing quality content on their own. You won’t find tutorials such as the ones we’ve written in our tutorials category or tutorials from our forums anywhere else.

Follow us on Twitter, Google+, Facebook, or YouTube. Check out our XDA Labs app for a fast way to browse our forums (and consider getting XDA Ad-Free too!) on your mobile device! Thanks, and stay tuned for our next tutorial!



from xda-developers http://ift.tt/2q9IbTN
via IFTTT

.

Android Auto 2.3 Hints at adding New Experimental Home Cards

Back during Google I/O 2016, Google announced that they would be rolling out an update to the Android Auto app to bring a driver-friendly user interface without needing an Android Auto compatible vehicle. This update didn’t roll out until November, several months after Google I/O, though. But it did eventually be released, as promised, even though the app has seen few updates since its initial release. Version 2.3 of the app started rolling out this week on the Google Play Store, and while we haven’t found much in the way of new features, an APK teardown of the app reveals that Google will soon add new cards to the home screen of the app.

Although an APK teardown can often predict features that may arrive in a future update of an application, it is possible that any of the features we mention here may not make it in a future release. This is because these features are currently unimplemented in the live build and may be pulled at any time by Google in a future build.


Android Auto Card Redesign

As of now, a few of the cards shown in the Android Auto app include your recent calls, your navigation status, and the status of any media that is currently playing back. But within the APK file of the latest Android Auto update are hints that Google may be adding more cards to the home screen page.

<string name="engineer_settings_enable_experimental_home_cards_title">Use Experimental Home Cards</string>
<string name="engineer_settings_home_cards_title">Home Cards</string>

As you can see, there appears to be a new toggle hidden within the app that allows you to use some new experimental home cards. We can see in a layout file that this new toggle is hidden in Android Auto’s Engineer Settings page where one of the most anticipated features of the app, WiFi Projection, can also be enabled.

engineer_preferences.xml

&lt;?xml version="1.0" encoding="utf-8"?&gt;
&lt;PreferenceScreen
xmlns:android="http://ift.tt/nIICcg"&gt;
&lt;PreferenceCategory android:title="@string/engineer_settings_wifi_title" android:key="wifi"&gt;
&lt;SwitchPreference android:title="@string/engineer_settings_enable_wifi_projection" android:key="enable_wifi_projection" android:defaultValue="false" /&gt;
&lt;/PreferenceCategory&gt;
&lt;PreferenceCategory android:title="@string/engineer_settings_parking_card_title" android:key="parking_card"&gt;
&lt;SwitchPreference android:title="@string/engineer_settings_parking_card_show_location_info" android:key="parking_card_show_location_info" android:defaultValue="false" /&gt;
&lt;EditTextPreference android:title="@string/engineer_settings_parking_card_max_speed" android:key="parking_card_max_speed_mps" android:defaultValue="" android:inputType="numberDecimal" /&gt;
&lt;/PreferenceCategory&gt;
&lt;PreferenceCategory android:title="@string/engineer_settings_home_cards_title" android:key="home"&gt;
&lt;SwitchPreference android:title="@string/engineer_settings_enable_experimental_home_cards_title" android:key="home_cards_experimental" android:defaultValue="false" /&gt;
&lt;/PreferenceCategory&gt;
&lt;/PreferenceScreen&gt;

The fact that this toggle cannot be accessed through regular usage of the Android Auto app did not deter us, however, as we figured out a way to access the hidden Engineer Settings of the app in order to enable these toggles! Unfortunately, even after enabling the new Experimental Home Cards toggle, I did not see any new cards. What these new home cards are supposed to do I am not sure of at this time.

I’ll continue digging around and update this article if I find anything interesting in the live build, or through an APK teardown. If you are looking for this latest release of the Android Auto, you can download it right now over at APKMirror. Follow our APK Teardown tag for more articles like this!



from xda-developers http://ift.tt/2q9nbw1
via IFTTT

.