Android NFC 'hacking' is ingenious, but not yet dangerous

The Black Hat Conference takes place in Las Vegas this week, where hackers, security experts and representatives from major companies meet to discuss all things relating to information security. If you're following the news out of the conference today, you may have come across reports of a new security vulnerability in Android (and NFC-enabled Meego phones) that could allow a malicious NFC (near-field communication) tag to beam malware directly onto your phone. Sounds terrifying, right? Now hackers can take over your smartphone without you even doing anything. But as is always the case with these kinds of security issues, it's not as simple as it seems, and this NFC 'hack,' sexy and technically impressive as it is, isn't really anything particularly scary to regular smartphone users.

Read on to find out why.

First off, we should quickly explain what NFC actually is. It stands for near-field communication, and it's a a very short-range wireless communication technology designed for sending small amounts of data instantly over very short distances. On smartphones, this can be used to transfer things like URLs from one handset to another, or alternatively to scan NFC "tags," which can themselves contain small quantities of data that the phone can then act upon. It can also be used for facilitate payments, for example via Google Wallet. (Read more in our Android A-Z)

Multiple sources report that security researcher Charlie Miller demonstrated a variety of techniques for hacking into the Nexus S (on Gingerbread), the Galaxy Nexus (on Ice Cream Sandwich) and the Meego-powered Nokia N9 at Black Hat this week. Many of the scariest exploits were found on the N9, but we'll focus on Android here, 'cause that's what we do. (And that's also what many of today's headlines focus on.)

Starting at the high end, on the Galaxy Nexus Miller demonstrated that NFC-enabled Android phones running Ice Cream Sandwich or later use Android Beam, a feature which some (but not all) them have turned on by default. Amongst other things, Beam lets users load URLs from another phone or NFC tag directly into the device's web browser. That means it's possible, with a malicious NFC tag, to send an unassuming user directly to a malicious web page. For that to work, though, the tag needs to be within the very short range at which NFC radios can operate -- basically all but touching the back of the device. Android Beam opens tagged URLs automatically without any prompt, by design. It's a valid security concern, but not an exploit in the traditional sense, as in order to do anything you need to find a vulnerability in the user's web browser of choice.

If you're using the built-in Android browser on Android 4.0.1, then such a bug exists, and that could allow a specially designed web page to run code on the device. Again, an entirely valid security issue, but using NFC as a delivery method for this kind of exploit is far from practical. (Not to mention Android 4.0.1 was only released on the Galaxy Nexus, a phone which has since been updated to Android 4.0.4 or 4.1.1, depending on your carrier.)

Miller also demonstrated how he could exploit bugs in Android 2.3's memory management to cause a Gingerbread device with NFC support to execute code using a malicious tag. That potentially gives an attacker the ability to take complete control of the device using only an NFC tag, but we should point out a few factors that make this a less serious issue that you might think. Sure, Android 2.3 Gingerbread is still the most-used version of Android, and many new Android devices ship with NFC support, but there's little cross-over between the two. The Nexus S was the first Android handset to support NFC, but that's since been updated to Jelly Bean. Other NFC-supporting devices may remain on 2.3, but most of the mainstream Android phones with NFC run at least version 4.0.3, which isn't vulnerable to the exploits used in this demo. In fact, we can't think of a single Gingerbread phone with NFC that's yet to be updated to at least Android 4.0.3.

So vulnerabilities certainly exist, but right now the only serious ones are limited to a very small subset of the Android population with NFC, and a very specific OS version. What's more, the phone needs to be powered on, the NFC radio needs to be enabled, and the user needs to be distracted enough so as not to notice the tell-tale NFC tone or vibration.

Ultimately, any exploit involving physical access to the device being hacked is going to be of limited use to the real bad guys. Taking control of a smartphone over NFC in the real world is going to be dangerous and impractical, even after the methods shown at the Black Hat Conference are publicized. If I have access to your phone, powered on, for an extended period, with malicious intent, NFC isn't going to be my first port of call. The exploits demonstrated by Charlie Miller this week are ingenious and cool to read about, but it's easy to exaggerate the real danger posed by them, especially when mainstream reporting of these hacks is light on important technical details.

Bottom line -- if you enjoy using NFC on your Android phone from time to time, you're safe to continue doing just that.

How Roku Could Win Media Streaming

How Roku Could Win Media Streaming

The Roku is a hell of a media streamer: its only real competitor is the Apple TV, but it costs half as much. No brainer. Which is exactly what News Corp and British Sky Broadcasting seem to think—as they've just ponied up $45 million to help Roku win the streaming race.

Announcing the investment this morning, Roku explained that it will be using the cash to expand its current organization and push forward with the Roku stick which it plans to launch this fall. The stick, which packs all the features of the small box currently available, will shove straight into the back of your TV. Completely unobtrusive, and potentially brilliant.

The investment will see News Corp's Chief Digital Officer Jon Miller join the Roku board, but most importantly it will give the company a shot in the arm which could see it jump from key player in the sector to market leader. It'll be exciting to see what Roku does next. [All Things D]

LARGE BREASTS: A FEMALE PERSPECTIVE

LARGE BREASTS: A FEMALE PERSPECTIVE

She's had big boobs for 20 years and here's her view from the other side of the mountains

by Sarah Miller

© iStockPhoto  

I'm 32, so let's say, roughly, that my breasts were on their path to greatness halfway through the De Klerk administration. By the time Mandela was sworn in, I was officially stacked.

I first realized I had big breasts when I was about 12, in, of all places, a fish market on Cape Cod. For years, the fishmonger had been showing my buxom aunt marked favoritism. "This is for you," he would say, measuring out what she'd asked for, then, with a wink and a glimpse at her bustline, tossing on a few more shrimp or an extra fillet.

On this particular day, he threw a handful of extra shrimp onto the pile and, ignoring my aunt, turned his gaze on me. "A little extra nutrition for the growing girl," he said. Holy hell, I said to myself, I have big boobs, too!

By the time I was 13, I had a C-cup, and by the time I was 15, a D. Today, I hover between a 34 and a 36D, depending on whether I'm on the Pill, and, disgustingly, how much beer I've been drinking. Either way, they garner their share of attention—wanted or otherwise.

There are times when it all seems quite silly to me, when I look at mine in the mirror and think, what a lot of excitement over two little—okay, enormous—mounds of fat! Then again, there's the occasional moment when I'll pull an old cotton T-shirt out of the dryer and slip it, still warm and quite tight, over my head, the name of my old university straining across my front.

And as I happen to catch a glimpse of myself in the mirror, I can't help but think of Teri Hatcher's line from that old Seinfeld episode: "They're real, and they're spectacular."

I know men like to think that women lie around all day touching and staring at their breasts. Well, every once in a while, in fact, we do. But aside from the odd afternoon interlude, most women don't find their own breasts especially sexual. Our breasts kind of have two—well, four—personalities. There is How We See Them. And then there is How Men See Them...
How We See Them

As fashion accessories. When I buy a dress, I don't consciously think, Wow, this is going to make all the men in the room want me. More like, How will it offset my best feature?

I know what you're thinking: Nothing low-cut was ever purchased in innocence. I swear to you, my breasts and I, we never conspire. We're just trying to look our best.

I feel about my breasts the way Audrey Hepburn felt about her neck. They're just part of my outfit, along with the right shoes, the right hose, the right earrings. All of which, of course, means nothing when confronted with...
How Men See Them

Simple: as the very focal point of the entire world. The male gaze flies past all my attempts to craft an individual style and makes a beeline for the breasts.

On the one hand, this is not so bad. I have worn the same tasteful yet cleavage-enhancing black dress to every party I've been to for 3 years. I've thought about buying a new one, but who would notice? Think: Who at your Thanksgiving table will complain about mashed potatoes or squash when your bird is so plump and juicy?

I am not always the best-looking or most sought-after girl at the party. But I always look appropriately festive, men tell me that I look nice, and if you ever spot someone waving a twenty at the bartender to get his attention...chances are that someone isn't me.

The downside is that many potentially fascinating conversations get lost inside my plunging neckline. For a while I tried wearing necklaces—I read in a women's magazine (a dubious source of information on any topic other than osteoporosis) that this would "draw the eye upward." Unfortunately, it merely provided an excuse for men's eyes to linger in this general area:

"Hey, is that a necklace? It's nice; where did you get it?"

"England."

"I've never been to England, but the longer I look at this necklace, you know, the more I feel I have."

My advice, should you find yourself chatting with an amply endowed female, is to practice restraint. It's not that we mind you looking at our breasts; it's just that seeing you do it is creepy. The stare, obviously, is bad, and the quick, subtle glance is never as quick or subtle as you hope.

Try using your powers of reconnaissance; stare sideways at a woman while you're talking to another man, and then, later, when you start up a conversation with her, look her in the eye while enjoying the mental picture of her breasts.

This might all sound complicated, but it's really not. For those of you who need a little motivation, remember that while prisoners get time off for good behavior, you get shirts off.

Of course, it's during the shirts-off phase that the difference between How We See Them and How Men See Them is most interesting. Men are always a bit amazed to see a pair of naked breasts, and their amazement level increases with quality and size.

So I come to that naked-from-the-waist-up moment with mixed emotions. On the one hand, I am so totally over these things. On the other hand, hello, you are beholding items of serious quality, and son, you'd better recognize it.

If this sounds like just one more damned-if-you-do, damned-if-you-don't chick rule, I apologize. I have always been a fan of the quick, sincere compliment. ("Whoa, nice rack," is not what I have in mind. "Wow, you have gorgeous breasts," is more like it). Living every day with these things, we tend to forget how interesting and sexy they are to people who don't live with them, and it's nice to be reminded.

That takes care of the talking part. As to what you do, well, it's really a matter of personal taste among consenting adults. I was with a group of women lately, and one wished her boyfriend would touch her breasts more when they had sex. Her friend made a face and said her boyfriend was much, much too fixated on hers. I suggested they switch boyfriends.
Bottom line:

If you ask most women what they like, they'll be happy to tell you.

After 20 years of having big breasts, I look down at them and ask, What have you done for me lately? I do get to walk around as the proud owner of these things that women want and men want to touch. On bad days, when I'm heartbroken, or just plain broke, I have consoled myself with this fact. (Yes, I do know that's lame.)

I'm aware of the preconception that women with big breasts can coast through life unchecked, but I haven't gotten as much free fish as you might think. Rental-car agents don't neglect to charge me when I scratch the Toyota Corrolla. When I speed, cops write me massive tickets just like everyone else.

I get the same amount of bad news and good news everyone else gets; it's just that whoever delivers it often does so staring at my boobs.

Still, even though women and men--possessors and obsessors--don't see breasts the same way, our two worldviews can coexist. We women need to remember that what we take for granted are two of your main reasons for living. You men need to remember that breasts are flesh and blood, not Fisher-Price toys.

Let's cut a deal. We'll wear nothing but low-cut shirts... if you promise to listen to everything we say when we're wearing them.

iPhone 5 will use nano-SIM

The iPhone 5 will be the first mobile handset to use the new nano-SIM design and European networks are already stocking-up

The iPhone 5 will be launched soon and it’ll be the first device to use the new nano-SIM card design, which is even smaller than micro-SIMs. 
A report from the Financial Times claims carrier networks in Europe are now stocking up on nano-SIMs in anticipation of the iPhone 5 release. 
The nano-SIM design was recently approved as new standard by the European Telecommunications Standards Institute (ETSI) after reaching an agreement with major manufacturers. 
There was some reasonably well-publicised competition between Apple and a collective of Motorola, RIM and Nokia, each with different proposals for the new nano-SIM design, but after prompting from ETSI the group eventually reached a consensus. 
The new cards are 40 per cent smaller than existing micro-SIMs, which are themselves still by no means ubiquitous – there are still plenty of handsets on the market using conventional, full-size SIM cards. Micro-SIMs first appeared with the iPad in 2010 and now several premium smartphone models use them, including the HTC One X and the Nokia Lumia 800. 
The new design measures 12.3mm long by 8.8mm wide and there’s now very little excess material surrounding the metal chip component. ETSI’s announcement assured that the new SIM could be ‘‘packaged and distributed in a way that is backwards compatible with existing SIM card designs.’ 
The smaller form factor of micro-SIMs and nano-SIMs enables manufacturers to come up with thinner, unibody phone designs, although current rumour surrounding the iPhone 5 suggests it’ll feature an aluminium back panel.

How to replace a broken screen on your iPhone

Cracking your iPhone's front glass or the display might not stop it from working, but can make it difficult and unsafe to use. Here's a step-by-step guide to fixing a broken front panel on your iPhone 4 or iPhone 4S.

Crack the front panel on your iPhone and you have three choices -- live with it, buy a new one, or get it fixed.

If you have AppleCare+ or another warranty that covers accidental damage, the choice is easy. Get your phone fixed or replaced under the warranty. If your iPhone isn't under warranty, you don't want to buy a new one, and you're ready to tackle a challenging, but satisfying, do-it-yourself fix, here's a guide for replacing the entire display assembly.

For more teardown photos of the iPhone, iPad, and other tech, check out my Cracking Open blog on TechRepublic.

Should you try this fix?
Before you jump into this DIY project, I suggest you watch my video on what to know before trying to fix a smartphone or tablet. It will help you decide if you should repair the phone yourself or take it to a shop.

Lastly, understand that if you follow the instructions in this video, you do so at your own risk. Neither CNET nor any of its representatives can be held responsible for injury, damage, or loss of data.

Getting replacement parts and tools
If you decide to tackle this fix, you'll need to get the necessary replacement parts and tools. As the iPhone's front panel and LCD are fused together, I suggest buying both as a single unit. You'll find them for between $70 and $120 dollars online. Just be sure that you buy the right one for your phone.

As for tools, you'll need a few thin metal blades, a plastic spudger or case-opening tool, tweezers, Phillips #000 screwdriver, a tiny flat-head screwdriver, and a special pentalobe screwdriver, which you'll use to remove the phone's tamper-resistant outer-case screws. Again, you can pick these up online if you don't have them.

Also, I'll be replacing the panel on an AT&T iPhone 4, but you can use same basic steps on an iPhone 4 from another carrier, and on an iPhone 4S. You may encounter differences, however, such as the location and type of vibration motor and the position of the motherboard screws.

1. Back up your data
The first step is to back up all the iPhone's data using iCloud or iTunes, just in case something goes wrong. You'll also need to eject the SIM card using the eject tool or a paper clip.

2. Remove the back cover
With those tasks complete, you can open the iPhone by removing the two screws located on the bottom edge. As noted above, you'll need a special pentalobe screwdriver for this task.

Then, slide the back cover upward and lift it off.

3. Remove the internal hardware
Before installing the new display assembly, you'll need to remove most of the iPhone's internal hardware, starting with the battery.

Remove the battery connector screw and disconnect the connector from the motherboard. Carefully remove the tiny pressure contact located under the connector -- noting its location and position for reassembly.

Pull up on the battery's plastic pull tab, and it should come loose from the frame.

Next, remove the metal shields that cover the upper portion of the motherboard and the docking connector cable. As you remove each screw, note its location. The screws are different lengths and will need to go back into their original positions.

Now, disconnect and remove the rear camera and then detach all the cables along the top and side of the motherboard. You'll need to gently pry the docking connector cable away from the metal shield underneath.

Remove the hidden motherboard screw located under the round white sticker near the battery pull tab, the screw under the docking connector cable at the bottom, and the metal standoff from the top near the headphone jack. Then remove the motherboard, lifting up from the bottom.

Lastly, remove the speaker enclosure and vibration motor. (Note: The location of the vibration motor will vary depending on the phone's model and carrier.)

4. Remove the broken display assembly
Finally, we can turn our attention to the broken display assembly. It's held to the metal frame with 10 screws: 3 each along the two sides and 1 in each corner. You'll need to remove them all -- keeping track of the washers under the 6 side screws.

Once the screws are removed, carefully insert a thin metal or plastic tool between the metal frame and front glass panel along either the top or bottom edge and gently pry the panel loose. (Note: Do not insert the tool too far or you may damage the phone's other internal components. And if the glass panel is cracked, take care not to injure yourself during the removal process.)

As you pull the panel away from the phone, you'll need to thread the two attached cables through the metal frame.

5. Install the new display assembly
First, remove the plastic film from the back of the display -- if it has one. Then carefully thread the display cables back through the frame, making sure not to crimp them in the process.

Gently press the panel onto the frame and secure it with the appropriate screws and washers.

6. Reassemble the iPhone
To reassemble the phone, work your way back through the previous steps. Start with the vibration motor, then install the speaker assembly, motherboard, rear camera, motherboard shields, battery, and finally the back cover.

As you work through the process, be careful not to damage any of the small metal contacts on the cable connectors, speaker assembly, or battery connector pressure contact.

As do-it-yourself fixes go, this one isn't too tough. It does however, take patience and attention to detail.

(Credit: Bill Detwiler/CNET)

5 things Marissa Mayer will change about Yahoo

Google's main products were driven by data, not art. Can the new Yahoo boss adapt that mindset from Google?

Google and Yahoo started as similar companies. Both were search giants, but at different points in their respective histories they diverged. The subsequent tale of the tape shows that Google's direction -- guided by strong leaders -- was the more successful path.

Here's what we can expect Mayer will bring to Yahoo.

The engineering culture that Mayer helped build at Google. Google has historically been run with an engineering mindset. The best Google services are fast, functional, and continually tested and improved as time goes on. Mayer herself was proud of talking about how even a tiny change in the position of an item on the Google Search page would be tested and evaluated over and over again. The company's main products were driven by data, not art.

Over time this has changed (see the Nexus Q, for example), but for its main products, Google is still driven by the numbers.

Mayer will likely bring this same rigor to Yahoo's products, in particular, the home page, Yahoo's portal to the Web. Her expertise in relentlessly tweaking products to extract maximum utility out of them could also extend to Yahoo Mail, still one of the largest e-mail providers. Yahoo applies a lot of data tricks in delivering its home page to its vast audience, but the key will be extracting more dollar value from the billions of Yahoo pages viewed. 

Related stories

• Google's Marissa Mayer becomes Yahoo CEO
• What hiring Marissa Mayer immediately does for Yahoo

Mayer has not run an entire company, though, so it may be a challenge for her to adjust the culture of Yahoo.

And it is the organizational culture at Yahoo that needs to most help. "Yahoo takes too long to make decisions," says Salim Ismael, who ran the Brickhouse project at Yahoo -- a group set up outside the standard reporting structure at the company so it could innovate more quickly. "On the Internet you need speed, and you need to take risk. Yahoo accidentally adopted a matrix organization structure that's antithetical to both," he says.

Yahoo could also use some of Google's ruthlessness in killing projects. The company gleefully reported on its 2012 spring cleaning project (which, for all we know, is ongoing). In a large, interlinked structure, which Yahoo apparently has, it's difficult to make the right decisions about killing products.

Google, though, maintains an optimism about its direction even as it chops down its underperformers. That's due, in part, to its capability to learn from its mistakes and not punish people involved in them. Even though Google killed social experiments like Buzz and Wave, it forged ahead with Google+. Even though its structured knowledge product Knol died, Google Search inherited a lot from the project.

And this points to another big strength of Google: the company is very good at working on long-term visions. Social has become key to the company's growth despite early failures. Google is also becoming a media company, throwing big money into hardware initiatives like Google TV and the Nexus Q media streamer, products that, in their initial incarnations, are not going to be remembered as successes. Google is also pushing to take a few market share points from Apple and Amazon in the media sales market.

It's much easier for a company that has resources like Google to play the long game, but a new CEO with Mayer's background and energy should be able to divert some funds to play some long-range bets and recruit some top talent back into the Yahoo fold.

Finally, there's the engineering-friendly culture of experimentation, or to put it in more shareholder-friendly terms, an R&D focus. Google is doing original research in areas that appear to be orthogonal to its mission -- self-driving cars, augmented-reality eyeglasses, and even energy. But these projects can pay off in numerous ways and their value can (but not always) feed back to the mainline business. On the other hand, Yahoo doesn't have the resources today to focus much beyond fixing what is broken at the company.

Can a media company be successfully run as an engineering company? Google, it needs to be said, actually is a media operation. It makes its money selling media advertising, and gathers 72 hours a minute of video on YouTube.  Can the same discipline work at Yahoo? There's probably no one better to give it a shot than Marissa Mayer.

Apple iOS 6 beta 3 is now seeding to developers

Apple iOS 6 beta 3 is now seeding to developers

Three weeks after iOS 6 beta 2 became available, Apple has began seeding the third beta version of its latest mobile OS. The iOS 6 beta 3 update is available as an over-the-air download to everyone running the previous release.

As always, the update offers various bug fixes and performance improvements. They include the addition of more 3D city flyovers in the Maps application, as well roadwork and traffic information. Furthermore, the update brings the beginning of the migration of MobileMe (me.com) email addresses to iCloud.com ones.

Source