Attacking the edges of secure Internet traffic

Researchers have uncovered new ways that criminals can spy on Internet users even if they're using secure connections to banks, online retailers or other sensitive Web sites.

The attacks demonstrated at the Black Hat conference here show how determined hackers can sniff around the edges of encrypted Internet traffic to pick up clues about what their targets are up to.

It's like tapping a telephone conversation and hearing muffled voices that hint at the tone of the conversation.

The problem lies in the way Web browsers handle Secure Sockets Layer, or SSL, encryption technology, according to Robert Hansen and Josh Sokol, who spoke to a packed room of several hundred security experts.

Encryption forms a kind of tunnel between a browser and a website's servers. It scrambles data so it's indecipherable to prying eyes.

SSL is widely used on sites trafficking in sensitive information, such as credit card numbers, and its presence is shown as a padlock in the browser's address bar.

SSL is a widely attacked technology, but the approach by Hansen and Sokol wasn't to break it. They wanted to see instead what they could learn from what are essentially the breadcrumbs from people's secure Internet surfing that browsers leave behind and that skilled hackers can follow.

Their attacks would yield all sorts of information. It could be relatively minor, such as browser settings or the number of Web pages visited. It could be quite substantial, including whether someone is vulnerable to having the "cookies" that store usernames and passwords misappropriated by hackers to log into secure sites.

Hansen said all major browsers are affected by at least some of the issues.

"This points to a larger problem — we need to reconsider how we do electronic commerce," he said in an interview before the conference, an annual gathering devoted to exposing the latest computer-security vulnerabilities.

For the average Internet user, the research reinforces the importance of being careful on public Wi-Fi networks, where an attacker could plant himself in a position to look at your traffic. For the attacks to work, the attacker must first have access to the victim's network.

Hansen and Sokol outlined two dozen problems they found. They acknowledged attacks using those weaknesses would be hard to pull off.

The vulnerabilities arise out of the fact people can surf the Internet with multiple tabs open in their browsers at the same time, and that unsecured traffic in one tab can affect secure traffic in another tab, said Hansen, chief executive of consulting firm SecTheory. Sokol is a security manager at National Instruments Corp.

Their talk isn't the first time researchers have looked at ways to scour secure Internet traffic for clues about what's happening behind the curtain of encryption. It does expand on existing research in key ways, though.

"Nobody's getting hacked with this tomorrow, but it's innovative research," said Jon Miller, an SSL expert who wasn't involved in the research.

Miller, director of Accuvant Labs, praised Hansen and Sokol for taking a different approach to attacking SSL.

"Everybody's knocking on the front door, and this is, 'let's take a look at the windows,'" he said. "I never would have thought about doing something like this in a million years. I would have thought it would be a waste of time. It's neat because it's a little different."

Another popular talk at Black Hat concerned a new attack affecting potentially millions of home routers. The attack could be used to launch the kinds of attacks described by Hansen and Sokol.

Researcher Craig Heffner examined 30 different types of home routers from companies including Actiontec Electronics Inc. and Cisco Systems Inc.'s Linksys and found that more than half of them were vulnerable to his attack.

He tricked Web browsers that use those routers into letting him access administrative menus that only the routers' owners should be able to see. Heffner said the vulnerability is in the browsers and illustrates a larger security problem involving how browsers determine that the sites they visit are trustworthy.

The caveat is he has to first trick someone into visiting a malicious site, and it helps if the victim hasn't changed the router's default password.

Still: "Once you're on the router, you're invisible — you can do all kinds of things," such as controlling where the victim goes on the Internet, Heffner said.

Playstation, TVs boost Sony to $294 million profit

Sony bounced back to profit last quarter and raised its full-year earnings forecast, fueled by stronger demand for its PlayStation 3 gaming consoles, personal computers and televisions.

The Tokyo-based electronics and entertainment giant said Thursday it booked a net profit of 25.7 billion yen — or $294 million at current exchange rates — for the April-June quarter. That was a sharp turnaround from a 37.1 billion yen loss a year earlier. Revenue grew 3.8 percent to 1.66 trillion yen.

Healthier sales stemmed mainly from consumers in emerging markets such as Asia and South America, which offset declines in Japan and the United States. Sony's business was strong enough to weather a stronger yen — which can make its products less competitive in overseas markets — and weakness in its financial services division.

Sony's entertainment arm posted solid results despite lower movie revenue. Sony blamed the decline on the absence of megahits like last year's "Angels & Demons" and "Terminator Salvation."

Music sales rose, however, thanks to popular titles such as AC/DC's soundtrack to "Iron Man 2" and music from the hit TV show "Glee."

Since taking over in 2005, Chief Executive Howard Stringer has been trying to unite the company's sprawling businesses, improve efficiency and rein in costs. Sony cut costs by more than 330 billion yen last year, while procurement costs declined by almost one-fifth.

The company is now rolling out new products. The maker of Bravia liquid crystal display TVs launched sales of its 3-D models last month. In May, the company partnered with Google Inc., Intel Corp. and Logitech International to offer Internet TVs.

It sold 5.1 million LCD TVs during the quarter, up 59 percent from last year. PlayStation 3 sales more than doubled to 2.4 million units.

Sony upgraded its forecast for the full year through March 2011 even as it expects the yen to keep appreciating. It now expects a net profit of 60 billion yen, up from its previous estimate of 50 billion yen. It kept its revenue projection unchanged at 7.6 trillion yen.

During the three months through June 30, the Japanese currency averaged 91 yen to the dollar and 115.5 yen to the euro, higher than the previous year, Sony said. Operating profit took a 13.8 billion yen hit as a result.

Operating profit — seen as an indicator of actual business performance — for the quarter was 67 billion yen compared with an operating loss of 25.7 billion yen in the same period last year.

In trading Thursday, Sony shares inched up 0.1 percent to 2,611 yen on the Tokyo Stock Exchange. It released earnings after the market closed.

India unveils prototype of $35 tablet computer

It looks like an iPad, only it's 1/14th the cost: India has unveiled the prototype of a $35 basic touchscreen tablet aimed at students, which it hopes to bring into production by 2011.

If the government can find a manufacturer, the Linux operating system-based computer would be the latest in a string of "world's cheapest" innovations to hit the market out of India, which is home to the 100,000 rupee ($2,127) compact Nano car, the 749 rupees ($16) water purifier and the $2,000 open-heart surgery.

The tablet can be used for functions like word processing, web browsing and video-conferencing. It has a solar power option too — important for India's energy-starved hinterlands — though that add-on costs extra.

"This is our answer to MIT's $100 computer," human resource development minister Kapil Sibal told the Economic Times when he unveiled the device Thursday.

In 2005, Nicholas Negroponte — cofounder of the Massachusetts Institute of Technology's Media Lab — unveiled a prototype of a $100 laptop for children in the developing world. India rejected that as too expensive and embarked on a multiyear effort to develop a cheaper option of its own.

Negroponte's laptop ended up costing about $200, but in May his nonprofit association, One Laptop Per Child, said it plans to launch a basic tablet computer for $99.

Sibal turned to students and professors at India's elite technical universities to develop the $35 tablet after receiving a "lukewarm" response from private sector players. He hopes to get the cost down to $10 eventually.

Mamta Varma, a ministry spokeswoman, said falling hardware costs and intelligent design make the price tag plausible. The tablet doesn't have a hard disk, but instead uses a memory card, much like a mobile phone. The tablet design cuts hardware costs, and the use of open-source software also adds to savings, she said.

Varma said several global manufacturers, including at least one from Taiwan, have shown interest in making the low-cost device, but no manufacturing or distribution deals have been finalized. She declined to name any of the companies.

India plans to subsidize the cost of the tablet for its students, bringing the purchase price down to around $20.

The project is part of an ambitious education technology initiative, which also aims to bring broadband connectivity to India's 25,000 colleges and 504 universities and make study materials available online.

So far nearly 8,500 colleges have been connected and nearly 500 web and video-based courses have been uploaded on YouTube and other portals, the Ministry said.

EBay 2Q profit rises 26 pct on PayPal, marketplace

EBay Inc. reported healthy second-quarter earnings Wednesday as more people transferred money through its PayPal payment service and shopped on its main website.

The online auction site operator also gave lower-than-expected guidance for the current quarter, predicting that a strengthening dollar will cut into overseas revenue because sales convert back into fewer dollars. That didn't seem to weigh on its shares, though, which rose in after-hours trading.

For the April-June quarter, eBay Inc. earned $412 million, or 31 cents per share. That compares with $327 million, or 25 cents per share, in the same quarter a year ago.

When excluding one-time items, eBay earned 40 cents per share — 2 cents higher than what analysts polled by Thomson Reuters expected.

Overall, revenue increased 6 percent to $2.2 billion, matching analyst predictions. It was $2.1 billion in the same period last year.

The company's growth came mainly from its second-biggest business, online payments, which includes PayPal and short-term credit service Bill Me Later. The unit's revenue rose 22 percent to $817 million, while total payment volume jumped 28 percent to $21.4 billion.

The payments business has grown swiftly as an ever-larger amount of consumers and merchants use it to send money online, on eBay and on other websites: In the second quarter alone, PayPal gained 3 million accounts, eBay said, to 87.2 million by the end of June.

EBay CEO John Donahoe believes that in the next few years that business' revenue will surpass that of eBay's marketplaces segment, which includes the flagship eBay.com and other e-commerce sites.

In a phone interview, Donahoe said that PayPal is growing on "all fronts and in all geographies."

Revenue from marketplaces rose 11 percent to $1.4 billion. The increase was helped by growth in eBay's European business, though the company also said growth in the U.S. was slower than expected.

"We still have work to do in the U.S. — our toughest and most competitive market — and we are not satisfied," Donahoe said during a conference call with analysts to discuss eBay's results.

The company's gross merchandise volume, which counts the value of everything sold on eBay, excluding vehicles, rose 13 percent to $12.5 billion. EBay had 91.8 million active users at the end of the quarter, compared with 88.4 million in the same quarter last year.

EBay, which is based in San Jose, has been working on improving its main site to lure and retain more shoppers, by doing things such as altering its search and feedback systems and lowering the upfront fees it charges sellers. Donahoe said Wednesday that he expects efforts to turn around the site will make "a lot more progress" in the next six to 18 months.

The company has also been focused on its mobile offerings, which let smart phone owners shop on eBay or transfer money through PayPal right from their small screens. It now has a slew of applications for Apple Inc.'s iPhone and phones running Google Inc.'s Android operating software, among others, and an app for Apple's iPad.

For the current quarter, eBay forecast an adjusted profit of 35 cents to 37 cents per share on $2.13 billion to $2.18 billion in revenue. Analysts have been looking for adjusted earnings of 39 cents per share on $2.2 billion in revenue.

The company also lowered its full-year outlook slightly, saying it now expects adjusted earnings of $1.60 to $1.65 per share on $8.8 billion to $9 billion in revenue. EBay had previously predicted adjusted earnings of $1.63 to $1.68 per share on $8.8 billion to $9.1 billion in revenue.

EBay shares rose 68 cents, or 3.4 percent, to $20.85 in after-hours trading. Before the release of results, it finished regular trading down 62 cents, or 3 percent, at $20.17.

The mysterious Droid 2 might launch as soon as August 12.

Just last week, we saw that the original Droid had been listed as an end-of-life device by Verizon, meaning that no more Droids will be shipping from Motorola and support for the device will slowly taper off.

While this news was slightly sad for the Droid faithful, it also meant one very exciting fact: The Droid's next-gen replacement must be waiting in the wings. So we're not too surprised to see that sources are saying the Droid 2 will be launching on August 12, about three weeks from today.

Here's what we know about the Droid 2 based on previously leaked photos and video:

* It will retain the original Droid's excellent physical keyboard, although the keyboard buttons will apparently be slightly more raised.

* Couldn't figure out what to do with that gold D-pad? No worries -- it's gone in this iteration.

* That weird ledge between the screen and keyboard layers of hardware is gone, so you'll have a nice, smooth device in your pocket or purse.

* The device will feature a Wi-Fi tethering app, just like the Droid X and EVO 4G.

* You'll also have a 750MHz OMAP processor, a 5MP camera and an updated version of Motoblur.

Reports also suggest there might be a special Star Wars edition of the Droid 2 that features a white R2-D2 on the back. As you may have noticed from watching various Droid commercials, "Droid" is actually a licensed term owned by Lucasfilms.

We're waiting to hear back from a few Verizon folks; if they have some confirmation or comment for us, we'll update this post.

In the meantime, let us know what you think in the comments. Will the Droid 2 perform as strongly as its predecessor, given the glut of Android-powered "superphones" now on the market? Or do you think the iPhone clones have an edge on this smaller, slightly less flashy device?

Apple, Google, and RIM all considered buying Palm

Now that Palm has become snugly ensconced in the bosom of Hewlett-Packard, HP is well on its way to using Palm’s new WebOS to create phones, PDAs, tablets, and more — in fact, it’s canceled or postponed plans to use both Android and Windows in various mobile products. It’s betting that heavily on WebOS.

But what might have happened if HP hadn’t ended up with the company?

Business Insider offers an interesting tale today about three other suitors who tried to nab Palm but failed. While the source is anonymous, the story sounds credible and is generally in line with public knowledge. Even if it’s not 100 percent on the money, it’s worthwhile as an analytical piece and a “what if” look at what could have been.

The most interesting suitor for Palm, per the interview, is Apple, which reportedly wanted Palm’s large library of patents that date back to the early days of mobile computing, beginning with the original Palm Pilot. That makes perfect sense, but what’s curious is that Apple reportedly said it would keep Palm running as a separate entity — which means continuing to develop its own line of phones — perhaps believing that Palm devices were not credible alternatives to the iPhone. This would have left Apple with two very different operating systems to support, and frankly, it sounds a little crazy. Ultimately, however, HP’s offer is said to have been (considerably) higher.

RIM, which makes the BlackBerry, reportedly had the deal locked up at one point, but in the end it didn’t bid high enough to complete it. In fact, it looks like RIM actually lowered its bid at some point during the negotiations, which opened the door for HP to sweep it away.

Another quite interesting prospective buyer, Google, is said to have considered a purchase of Palm only because Apple was interested, and never bid because it assumed Apple hadn’t either.

Lenovo also appears to have made a proposal to buy the company, but either the deal was too cheap or was going to take too long to pan out.

In the end, the spoils go to HP, a decent fit for the company and its long history of developing mobile products, and longer history of sitting the market out. Definitely looking forward to seeing how these two work together, and this little bit of back story only makes that more tantalizing.

Consumer Reports 'can't recommend' new iPhone

The iPhone 4's widely reported "death grip" problems are real, Consumer Reports claims — so real, in fact, that the nonprofit group has decided not to recommend the latest iPhone. For those who've already snapped up an iPhone 4, Consumer Reports has a somewhat unorthodox suggestion: duct tape.

On the official Consumer Reports blog, analyst Mike Gikas writes that he tested three iPhone 4 handsets in the "controlled environment" of a radio frequency isolation chamber, which is "impervious" to outside radio interference.

The researchers found that if you touch the iPhone 4 in a specific spot on the lower-left edge of the handset (an "easy thing, especially for lefties"), the cellular signal "can significantly degrade enough to cause you to lose your connection altogether," especially if you're in a "weak signal" area," Gikas writes.

That's pretty much in line with the findings of other wireless experts and customers (myself included) who've experienced the "death grip" problem on the iPhone 4, which differs from older iPhone models in that its antenna is built into a stainless-steel band that rings the outer edge of the handset.

The main culprit appears to be a gap in the band separating the Wi-Fi, Bluetooth, and GPS segment of the antenna from the section for cellular GSM and 3G reception. Experts believe that if you touch the gap and "bridge" the two antenna segments, you may lose reception and even drop calls.

Apple acknowledged the new iPhone's reception problems in a letter a little over a week ago that blamed the issue on the handset's reception display, which Apple claims was showing too many bars in areas with a weak AT&T signal. Apple says an upcoming software update will include a new "formula" for determining how many bars of signal strength should be displayed at any given time.

Consumer Reports' Gikas, however, says that his new findings "call into question" Apple's excuse that "an optical illusion caused by faulty software" lies at the root of the iPhone 4's reception problems.

That said, Gikas notes that there is an "affordable" fix for iPhone 4 owners other than Apple's $30 Bumper cases: duct tape, or "another thick, nonconductive material." "It may not be pretty," Gikas says (now there's an understatement), "but it works."

Consumer Reports is withholding a recommendation for the iPhone despite the fact that it earned high scores in other smartphone categories thanks to its "improved" battery life, built-in gyroscope for precise motion detection, and the "sharpest display and best video camera we've seen on any phone."

Of course, the iPhone 4 still could get a coveted "recommended" rating from Consumer Reports, Gikas adds, as soon as Apple devises "a permanent — and free" solution to the iPhone's "death grip" problem, presumably one that doesn't involve a length of Apple-branded electrical tape.

Wake up, check Facebook: Americans increasingly obsessed

Americans are increasingly obsessed with Facebook and many young women check their page even before using the bathroom in the morning, according to a poll released on Wednesday.

Thirty-four percent of the women aged 18 to 34 surveyed by Lightspeed Research for Oxygen Media said checking Facebook was the first thing they did in the morning, even before washing their face or brushing their teeth.

Twenty-percent admitted they sneak a peek at Facebook during the night while 26 percent said they get up in the middle of the night to read text messages.

Thirty-nine percent of the 1,605 social media users aged 18 to 54 surveyed for Oxygen Media, a service of entertainment giant NBC Universal, in May and June described themselves as "Facebook addicts."

Fifty-seven percent of the women aged 18 to 34 said they talk to people online more than face-to-face and 31 percent said they feel more confident about their online persona than their real life one.

Sixty-three percent of the young women said they use Facebook as a career networking tool, but 42 percent said they did not think there was anything wrong with posting photos of themselves visibly intoxicated.

Forty-eight percent of the young women said they find out about news through Facebook while 41 percent said they use Twitter to keep up to date.

Fifty percent of single women aged 18 to 34 said it's okay to meet and date other singles they meet through Facebook compared with 65 percent of single men.

Six percent of the young single women use it as a way to "hook up" as opposed to 20 percent of men.

Men aged 18 to 34 are also more likely than female counterparts to break up using Facebook -- 24 percent for men compared with nine percent for women, the survey found.

InsideFacebook.com, a site dedicated to the social network, said meanwhile that Facebook's growth slowed in the United States in June as it picked up only 320,800 new monthly active users last month compared with 7.8 million in May.

Inside Facebook said the slowdown in growth could "simply be a blip."

"But in the years we've been tracking the demographic data, we've rarely seen a dip like this, so we would tend to favor the idea of a root cause," it said.

"One possibility is that we're finally seeing the backlash from heavy media attention to Facebook privacy issues -- some of which were real, some the result of confusion and sensationalism," it added.

US largely ruling out NKorea in 2009 cyberattacks

U.S. officials have largely ruled out North Korea as the origin of a computer attack last July that took down U.S. and South Korean government websites, according to cybersecurity experts.

But authorities are not much closer than they were a year ago to knowing exactly who did it — and why.

In the days after the fast-moving, widespread attack, analysis pointed to North Korea as the likely starting point because code used in the attack included Korean language and other indicators. Experts now say there is no conclusive evidence that North Korea, or any other nation, orchestrated it.

The crippling strikes, known as "denial of service" attacks, did not compromise security or breach any sensitive data or critical systems. Officials and experts say the agencies are better prepared today. But they acknowledge that many government and business sites remain vulnerable to similar intrusions.

The incidents underscore the increasing threats posed by computer-based attacks, and how they can disrupt service as well as inflame political tensions.

Pinpointing the culprits for such attacks is difficult or even impossible, officials say. Some suggest the July 4 weekend attacks a year ago may have been designed as a political broadside.

These officials point suspicions at South Koreans, possibly activists, who are concerned about the threat from North Korea and would be looking to ramp up antagonism toward their neighbor. Several experts familiar with the investigation spoke on condition of anonymity because the results are not final.

According to U.S. officials and private computer analysts, the attacks were largely restricted to vandalizing the public Web pages of about a half dozen federal agencies, including the Treasury Department and the Federal Trade Commission. About three dozen other sites were targeted, including some private companies and a number of South Korean government sites, which reportedly had the most damage.

While the questions of who did it and why are unanswered, many investigators and experts now do not consider it a critical case.

"It's about as frightening as someone driving around the block blowing their horn a lot," said James Lewis, cybersecurity expert and a senior fellow at the Center for Strategic and International Studies. "A lot of people could have done it, and it doesn't leave a lot of clues to their identity."

To Don Jackson, director of threat intelligence for Atlanta-based SecureWorks, a computer security consulting company, "it's a dead end as far as who did it. I don't think we've ever gone past that."

Those responsible, he said, "pulled it off so well, managed it so well — this was someone who has experience at running these types of attacks."

Jackson, whose company was among several private firms that studied the codes after the attack, said one possibility is that hackers in South Korea were the culprits.

South Korean sources had a mission and may have "wanted someone blamed for it," said Jackson. "It would further the point that North Korea has elite squads" of hackers targeting Seoul.

South Korean officials have pointed to North Korea as the suspected assailant, and experts agree that it is within the North's abilities to wage cyberattacks. More recently, however, a government-run website in South Korea was hit with a similar — although smaller — denial of service attack that officials said was traced to China.

"There are a number of national intelligence agencies who are creating cybercapabilities. It's a natural area of exploration," said retired Gen. Wesley Clark. "I wouldn't underestimate North Korea's potential in this space."

Denial of service attacks, Lewis said, don't leave detailed forensic clues that a more directed intrusion, such as an effort to breach a sensitive government program, might leave.

Still, officials worry that even a large, well executed attack against critical controlling computer servers could interrupt service if directed at a power company or utility. A strike could disrupt financial markets if directed at Wall Street or hinder travel if aimed at transportation sectors.

Those systems tend to be more heavily protected. But an attack against a bank's website could prevent customers from having online access to their accounts and prevent them from paying bills. Such attacks can prove lucrative as an extortion tool, when hackers take down popular gambling sites and demand payment to end the disruption.

Despite the lack of a clear culprit, there are things investigators do know about last year's denial of service attack.

The malicious computer code was distributed through nine main control servers in four countries. It fanned out to infect about 60,000 computers around the world. Those computers — likely on the desktops of innocent victims — were linked together in what is called a botnet, and they flooded government websites with traffic, knocking them offline or slowing them down over the Independence Day holiday weekend.

Altogether, 43 sites were targeted, and the size of the attack suggested it required several people to carry it out. While some Treasury, FTC and State Department sites were slowed or shut down by the software attack, others such as the White House and Department of Homeland Security were able to fend it off with little disruption.

Other targets included Nasdaq and New York Stock Exchange, Voice of America, U.S. Postal Service, and Amazon and Yahoo.

Government officials and analysts say there has been some improvements in dealing with future strikes. Private contractors, such as the web hosting giant Akamai, has a redundant system that will move government sites to other servers if one is seeing an unusual or massive flow of traffic.

Agencies are now better prepared.

But, Jackson said, "as far as any better capability in tracking down actors or in attributing attacks to any individual or group, I don't know that we're any further along. I would seriously doubt it."

Apple `stunned' to find iPhones show too many bars

Apple Inc. said Friday that it was "stunned" to find that its iPhones have for years been using a "totally wrong" formula to determine how many bars of signal strength they are getting.

Apple said that's the reason behind widespread complaints from users that the latest model, iPhone 4, can show a sudden plunge in signal strength when they hold it in a way that covers a small black strip on one edge of the phone. Users online have jokingly called this the "death grip" for the phone.

That drop seems exaggerated because the phone can wrongly display four or five bars of signal strength when it shouldn't, Apple said.

"Their big drop in bars is because their high bars were never real in the first place," the company said in a letter to users.

Apple launched the iPhone 4 on June 24 in the U.S. and four other countries.

Some outside engineers and users have blamed the iPhone 4's apparent reception problems on the novel design that incorporates its antenna into the case. But the company said that any phone will show reduced reception if held in a way that covers the antenna, usually mounted at the rear and bottom of a phone. It maintains that iPhone 4's wireless performance is better than previous models. And it said the incorrect signal-strength formula existed in the original iPhone, launched in 2007.

Apple, which is based in Cupertino, Calif., said it will fix its signal strength formula to conform to other AT&T phones through a free software update for iPhone models 3G, 3Gs and 4 within a few weeks.

"We are also making bars 1, 2 and 3 a bit taller so they will be easier to see," Apple said.

Despite recurring complaints about dropped calls and slow data service, particularly in the U.S., the iPhone is a standout success, with each model selling faster than the previous one. Apple said it sold 1.7 million iPhone 4s in its first three days, essentially running out of stock.

AT&T Inc., the exclusive iPhone carrier in the U.S., has faced much of the users' blame for dropped calls and poor wireless performance. Apple apologized to customers Friday "for any anxiety we may have caused."