Subtitle Hack: 200 Million Devices Are Vulnerable, Download Fix For VLC, Kodi, Etc.

A simple but malicious subtitle file can be used to gain control of your PC, TV or smartphone. Check Point researchers have spotted vulnerabilities in VLC, Kodi, Stremio, and Popcorn Time in the way these media players handle subtitle files. As of now, fixes have been released for the media players.

According to a blog post published by Check Point security, a subtitle file could be modified to create a new attack vector and compromise the devices such as PCs, mobile devices, TVs, etc running vulnerable media players. Once compromised, the attacker can perform remote code execution, steal data, use the device as a pawn in a DDoS attack, and more.The researchers say, delivering a cyber attack when subtitles are loaded onto a media players is a “completely overlooked technique”.Most of the people download subtitles files from repositories on the web without giving a second thought, treating them as no more than innocent text files.The researchers say that attackers can upload a malicious subtitle on a repository and manipulate the rankings to put their results on the top. This could result in an increase in manual download counts and automatic download counts (by media players).They also note that subtitles aren’t considered as a threat in comparison to traditional attack vectors which are well-known to security companies and users. That’s the reason a malicious code hiding in a subtitle file could easily sneak through filters deployed by antivirus software.The actual vulnerability lies in the way the media players handle subtitle files. One aspect that contributes to the complexity of the whole thing is a large number of subtitle formats each having its own set of features. Currently, there are around 25 subtitle formats in circulation.Different media players have their own method of parsing and combining different subtitle formats in order to enhance user experience. As a result, the researchers were able to find distinct vulnerabilities in affected media players.The list of affected media players includes VLC, XBMC Kodi, Popcorn Time, and Stremio. However, the researchers don’t exclude the possibility of the exploit existing on other media players. 

The researchers haven’t published further details as the developers are currently investigating the vulnerability.Each of the affected media players has millions of users with VLC topping the list. The last release of VLC (June 5, 2016) has been downloaded more than 170 million times. In total, the researchers estimated that around 200 million devices running the affected media players are exposed to the attack.

Download Subtitle Hack Fix:

Check Point researchers contacted the developers of the affected media players in April 2017. Thankfully, the security patches have been released.

In the case of VLC, the attacker can leverage memory corruption bug. The media player had four vulnerabilities (CVE-2017-8310, CVE-2017-8311, CVE-2017-8312 and CVE-2017-8313) which have been fixed by VideoLan.

A fix for VLC is available as the latest version 2.2.5.1 which is present on the VideoLan’s website. The same is the case of Stremio.

The developers of Popcorn Time and Kodi have created a fix, but it’s not released for public yet. For Popcorn Time, you can download the fix manually using this link provided by the researchers. Head over to GitHub where you can find a source code fix for XBMC Kodi.

Read More

This Device Can Fix Bad Wi-Fi In Your Home

Comcast is taking steps to improve the value that customers get from its routers. This year Comcast will begin rolling out a service to its 10 million current Xfinity internet customers during the first half of this year that features a host of benefits we’ve seen from companies like Eero and Starry.  It won’t cost anything extra. New customers will be able to get the new Gateway router too. Comcast will also start offering a new router with faster connection speeds and other internal upgrades for improved WiFi.

Here’s a rundown of the most important things you’ll be able to do with your Comcast Xfinity service when it starts rolling out soon.

• Easily set up your network: The Comcast router has a QR code that you take a photo of with the Comcast app. This will guide you through an easy setup process.
• Monitor connections and enable parental controls: Using the Comcast app, you can manage who has access to your network by creating profiles for each person and their devices. For parents, you can disable a device’s connection when your kids are supposed to be doing homework, eating dinner, going to bed, or any other boring activity you can think of. Go wild.
• Troubleshoot connections and extend your WiFi’s range: If you live in a large home or one with thick walls that interrupt your WiFi connection, Comcast’s app can help optimize your network. You can also add extenders that automatically boost your primary router’s signal to hard-to-reach areas of your home. It’s very similar to what we’ve seen with routers from Google and Eero.

Comcast estimates 15 million customers will have the service this year. You may not save any money like you can using your own modem or router, but it does give you a peace of mind that it’ll be a lot easier to manage your WiFi, especially since those similar products from Google, Eero, and Starry can get pretty expensive

Read More

Home lighting latest technology.

Home lighting the latest technology to go wireless:

Melbourne-based technology startup LIFX has the not-so-humble goal of reinventing the light bulb.

Founded by 40-year-old Australian inventor Phil Bosua, the company sells a $129 multi-colour LED light bulb that’s almost as easy to install as a regular bulb. It screws into existing light sockets, but rather than being turned on and off at a light switch, it’s wirelessly controlled from an iPhone or Android phone.

Far from the traditional white or yellow hues of a regular light bulb, the LIFX has access to a palette of more than 16 million colours. From the free app, users can manage each LIFX light bulb in the house, set the colour and brightness of bulbs individually or as a group, and set up lighting effects such as music visualisation (where the light pulses in time to music) and candle flicker.

ess than a week after it made its debut on the crowdfunding site Kickstarter in September 2012, it had raised $1.3 million – well above its original $100,000 target – making it one of the most successful Kickstarter projects to date.

Since then, the company has shipped more than 100,000 bulbs to about 70 countries, and its goods can be purchased online as well as through retail partners such as Best Buy in the US and Harvey Norman in Australia.

As with many great ideas, Bosua first came up with it while he was drinking beer with a friend.

‘‘A friend of mine told me he was renovating his house and needed to put a light switch in without having to cut up bricks and run a wire down the wall,’’ Bosua says.

‘‘He said, ‘You’re the inventive type – do you know any way you can turn your lights on and off wirelessly?’’’

Bosua’s first thought was that it could be done with a smartphone, but when he did some research he discovered there was nothing on the market. This, he says, was literally his light-bulb moment.

Technology analyst firm Telsyte forecasts that the smart lighting market in Australia will exceed $100 million by 2017. Over the next three to four years, it’s expected to reach mainstream status, driven by falling prices and centralised management platforms that leverage iOS and Android.

‘‘In the past, if you wanted to do home automation, it would be very expensive. You’d have to put in cabling, you’d have to rip out walls,’’ says Telsyte managing director Foad Fadaghi. ‘‘Today, the cost effectiveness of wireless and cheap Wi-Fi components has made it a lot easier to adopt home automation systems. What we’re seeing now is the democratisation of smart home technology.’’

LIFX has stiff competition from larger players in the smart home technology category. Multi-national technology company Philips released the Hue smart LED bulb one month after the LIFX hit Kickstarter, and beat the Melbourne start-up to the market by more than a year. At $249.95 for the starter pack (which includes three light bulbs and a bridge that needs to be plugged into a Wi-Fi router) and individual light bulbs for $69.95 each, the Hue is also cheaper than the LIFX.

Belkin, one of the leading providers of do-it-yourself smart home automation gadgets, will soon be releasing an even cheaper smart LED light bulb that hooks into the company’s WeMo ecosystem of smart power switches, motion sensors and webcams. The starter pack will cost $169.95 and include two smart light bulbs and a bridge to plug into the Wi-Fi router. Additional light bulbs will be available for $49.95 each.

But Bosua isn’t sweating his competitors. At the recent international 2014 Edison Awards, LIFX beat the Philips Hue to win the gold medal for smart systems in the consumer goods category.

Last week LIFX also secured $12 million in Series A funding, bringing the company’s total funding to $16.6 million.

‘‘We’re thinking within the next two to three months all of the features we originally promised on the Kickstarter project, such as timer scheduling and auto-increasing and dimming lights, will be completely built, and then we’ll be able to start rolling out some of the other really cool things that we’re working on,’’ said Bosua. ‘‘We’re also going to release different form factors, and we’re really far down the prototype stage of a LIFX light switch.’’

Read More

Google Glass wearers can steal your password

By usama.asif July 14, 2014: 2:26 PM ET

Remember the kid who tried to cheat off you by looking over your shoulder to copy your test answers? He's baaaack.

But this time he's wearing Google Glass -- and he's after your iPad PIN.

Cyber forensics experts at the University of Massachusetts in Lowell have developed a way to steal passwords entered on a smartphone or tablet using video from Google's face-mounted gadget and other video-capturing devices. The thief can be nearly ten feet away and doesn't even need to be able to read the screen -- meaning glare is not an antidote.

The security researchers created software that maps the shadows from fingertips typing on a tablet or smartphone. Their algorithm then converts those touch points into the actual keys they were touching, enabling the researchers to crack the passcode.

They tested the algorithm on passwords entered on an Apple (AAPL, Tech30) iPad,Google's (GOOGL, Tech30) Nexus 7 tablet, and an iPhone 5.

The software can be applied to video taken on a variety of devices: Fu and his team experimented with Google Glass, cell phone video, a webcam and a camcorder. The software worked on camcorder video taken at a distance of over 140 feet.

Of course, pointing a camcorder in a stranger's face might yield some suspicion. The rise of wearable technology is what makes this approach actually viable. For example, a smartwatch could stealthily record a target typing on his phone at a coffee shop without drawing much attention.

Fu says Google Glass is a game-changer for this kind of vulnerability.

Read More

Dell Inspiron 15 Core i7 touchscreen laptop

ET deals: Dell Inspiron 15 Core i7 touchscreen laptop for $700.

By usama.asif on july 11,2014 at 4:35 pm.

DESCRIPTION

A Core i7 processor in a laptop can be enough to push the price up to $700 pretty much by itself, so we were pretty excited to spot today’s deal from Dell. You can pick up a well outfitted Inspiron 15, sporting both a Core i7 processor and a touchscreen, for just $700 after a limited time coupon code is applied.

This laptop features a Core i7-4510U CPU, a low voltage processor that will work to maximize your battery life while still delivering premium performance. In addition to the powerful processor, you’re also getting a 15.6-inch 10-finger capacitive touch screen, which will let you tap, pinch and swipe your way through everything Windows 8 has to offer. Both in terms of touch-friendliness and power, this is a computer that has the chops to handle your needs for years to come.

Dell has also included plenty of memory on this notebook. A 1TB hard drive provides plenty of storage for your media, and the included 8GB RAM will make multitasking easy. One thing to note is that there’s no DVD-RW drive here, a sacrifice made to trim down the size and price.

On the connectivity side you’re getting strong Wireless-AC 3160 WiFi, as well as Bluetooth 4.0. There are three USB ports (two USB 3.0) as well as HDMI 1.4a and a card reader for your physical connections, giving you plenty of options when it comes to hooking up and accessing your peripherals.

You’re also getting some nice extras here, like a backlit keyboard and a full year of McAfee LiveSafe preloaded. Dell covers this with a 1 year warranty plus 90 days of premium phone support to get you started.

Grab this deal today and save a huge 44% while it’s here.

Dell Inspiron 15 (5000-series) Core i7 touchscreen laptop for $699.99. Apply coupon code 0GJHSKM3CG$C1H to get full $540 savings.

Read More