Windows 8 - Deeper Impressions

[JorgeA]

Whoops:

Microsoft Pulls Surface Pro 2 Firmware Update

Microsoft on Wednesday took the unusual step of pulling its most recent firmware update for the Surface Pro 2, acknowledging problems that users had attributed to the update. It will release an alternative update "after the holidays."

.

This is especially a problem for those who have already installed the faulty update, which was delivered as part of Microsoft's December Surface updates. (See Microsoft Surface Firmware Updates for December 2013 for the details.) That's because many of those users are experiencing dramatically lower-than-usual battery life since installing the update.

I couldn't have put it better than Paul did:

Not exactly good customer service, especially from a part of Microsoft that, frankly, can't really afford this kind of controversy right now.

--JorgeA

[bpalone]

More news on the security front. Some researchers have discovered that they can learn a great deal by just listening to your computer. From their paper it appears that that what can be learned is quite alarming. I will quote part of the opening paragraph here, but I recommend that you go look through at least their web page disclosing the news.

Many computers emit a high-pitched noise during operation, due to vibration in some of their electronic components. These acoustic emanations are more than a nuisance: they can convey information about the software running on the computer, and in particular leak sensitive information about security-related computations.

The website with a link to their full paper is here: http://www.cs.tau.ac.il/~tromer/acoustic/

Just makes one feel all warm and fuzzy.

bpalone

[bpalone]

More on the turning on and using of the embedded camera without your knowledge, as was mentioned in this thread a few days ago. This is about a MacBook being used, but I'm assuming the same concept works on any platform, so here a couple of quotes and a link to the article.

MacBooks are designed to prevent software running on the MacBook’s central processing unit (CPU) from activating its iSight camera without turning on the light. But researchers figured out how to reprogram the chip inside the camera, known as a micro-controller, to defeat this security feature. In a paper called “iSeeYou: Disabling the MacBook Webcam Indicator LED,” Brocker and Checkoway describe how to reprogram the iSight camera’s micro-controller to allow the camera and light to be activated independently. That allows the camera to be turned on while the light stays off. Their research is under consideration for an upcoming academic security conference.

And then the REAL BIG disclosure:

Luckily, there’s an easy way for users to protect themselves. “The safest thing to do is to put a piece of tape on your camera,” Miller says.

We should all be real proud of ourselves here. We had already mentioned that security measure.

The full article is here: http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/18/research-shows-how-macbook-webcams-can-spy-on-their-users-without-warning/

bpalone

[Monroe]

"Some researchers have discovered that they can learn a great deal by just listening to your computer."

This just gets worse by the day. So now we need a "scrambler" of some sort in our computers or just play Britney Spears music real loud all day ! ... JorgeA had it right, put a bandage over the camera and microphone.

I like these ... they look better than a bandage ... Self-Stick Round Felt Pads

http://www.amazon.com/Waxman-Self-Stick-Round-Brown-8-Inch/dp/B000VYN7CS/ref=sr_1_1/189-8537245-9922643?ie=UTF8&qid=1387455616&sr=8-1&keywords=small+felt+pads

...

[jaclaz]

... or just play Britney Spears music real loud all day !

That would really be cruel (after all the good guys from NSA that will listen to it are good chaps) .

About the botched Surface 2 update, traditionally MS excuse (about botched updates for conventional PC's) was "there are so many different possible combinations of hardware that notwithstanding our extensive testing it is still possible that this update is conflicting with some other installed software on a minimal amount of PC's"

Proof we are not alone:

http://www.pcdoctor-community.com/blog/posts/2013/10/22/9-Things-Microsoft-Could-Do-To-Fix-Windows-8.1/

jaclaz

Edited December 19, 2013 by jaclaz

[TELVM]

... Proof we are not alone:

http://www.pcdoctor-community.com/blog/posts/2013/10/22/9-Things-Microsoft-Could-Do-To-Fix-Windows-8.1/

^ Greater truths were never said.

[JorgeA]

More news on the security front. Some researchers have discovered that they can learn a great deal by just listening to your computer. From their paper it appears that that what can be learned is quite alarming. I will quote part of the opening paragraph here, but I recommend that you go look through at least their web page disclosing the news.

Many computers emit a high-pitched noise during operation, due to vibration in some of their electronic components. These acoustic emanations are more than a nuisance: they can convey information about the software running on the computer, and in particular leak sensitive information about security-related computations.

The website with a link to their full paper is here: http://www.cs.tau.ac.il/~tromer/acoustic/

Just makes one feel all warm and fuzzy.

bpalone

Unbelievable.

Sometimes it is said that ever-expanding knowledge will produce a kind of human paradise, but the more these sorts of things come out, the clearer it is to me that it'll actually lead to a sort of h*!!.

--JorgeA

[JorgeA]

... Proof we are not alone:

http://www.pcdoctor-community.com/blog/posts/2013/10/22/9-Things-Microsoft-Could-Do-To-Fix-Windows-8.1/

^ Greater truths were never said.

Yeah, he has a lot of good ideas in there (thanks @jaclaz for the link).

My favorite one is

4. Integrate Metro with the desktop

Metro doesn't work for mouse and keyboard users in its current form. It simply can't be fixed. Instead of trying to force desktop users into Metro, bring Metro to the desktop. Gadgetize all Metro features. Allow Metro tiles to be dropped on the desktop like gadgets. Allow Metro apps to run in a window like desktop apps.

Thyis would solve so many problems. But, as he said (and I suspected over a year ago), Windows Gadgets were disabled so as to make the Win7 Desktop look static and boring compared to the dynamic-looking Metro screen with its constantly changing and updating tiles.

--JorgeA

[JorgeA]

In cybersecurity news:

Exclusive: Secret contract tied NSA and security industry pioneer

As a key part of a campaign to embed encryption software that it could crack into widely used computer products, the U.S. National Security Agency arranged a secret $10 million contract with RSA, one of the most influential firms in the computer security industry, Reuters has learned.

Documents leaked by former NSA contractor Edward Snowden show that the NSA created and promulgated a flawed formula for generating random numbers to create a "back door" in encryption products, the New York Times reported in September. Reuters later reported that RSA became the most important distributor of that formula by rolling it into a software tool called Bsafe that is used to enhance security in personal computers and many other products.

Undisclosed until now was that RSA received $10 million in a deal that set the NSA formula as the preferred, or default, method for number generation in the BSafe software, according to two sources familiar with the contract. Although that sum might seem paltry, it represented more than a third of the revenue that the relevant division at RSA had taken in during the entire previous year, securities filings show.

Security compromised by design. :angrym:

--JorgeA

[TELVM]

thats why I fake output browser string, as I'm using Opera 11 some sites block it coz it is "outdated" yet it isn't

so my fake output string is Firefox 25, then when I reload the page they let me in, or in case like this the annoying warning goes away

Neat trick, I'd like to try it! Any tips on how to do this, or is it considered un-kosher?

--JorgeA

Its a User Agent switcher. I have those mods in Firefox/Palemoon too. I primarily use them for development/debugging and don't actually use it on a constant basis.

How to change your Firefox/PaleMoon user agent string directly by you own hand, without installing any extensions.

· Type about:config in the address bar and press Enter.

· Pay no attention to the warning and click on.

· Type useragent in the filter box. If the preference general.useragent.override does not exist create it by right-clicking, selecting 'New', and selecting 'String'. Name the new preference general.useragent.override .

· Enter your desired user agent as the value of the preference. For instance this string masquerades PaleMoon 3.6.32 running on WinXP as Firefox 25 :

Mozilla/5.0 (Windows NT 5.1; en-US; rv:25.0) Gecko/20100101 Firefox/25.0

(This new setting will persist until we change it, even if we close and reopen the browser. To revert to the default user agent, we must right-click the general.useragent.override preference and select 'Reset'.)

· Enjoy the web without the bloody yada yada about updating your browser B) .

[Monroe]

Since User Agents have been mentioned ... here's (there are many) a couple good sites to get information on what you're putting out on the web. Also, if you are using Proxomitron (as I do) then you have to temporary place it on Bypass to get a true UA reading. Proxomitron will ID you as using Windows 7 with the Sidki filter set, even if you are using Windows XP or Windows 98SE.

User Agent Details

http://user-agents.my-addr.com/custom_user_agent_lookup-ua_string_analysis_checker_tool.php?i=30383&u=_Mozilla_4_0_compatible_MSIE_6_0_Windows_NT_5_1_

Just paste UA in the space ...

also

user-agent-string.info

http://user-agent-string.info/parse

... just to add about the Qt Web browser which I mention briefly in an earlier post. It has a large amount User Agents available but you can just add the one you like under Custom and it stays as a permanent User Agent till you change it ... not going away when you close and restart Qt Web. I'll post the link again if anyone wants to check it out further. If you go into Edit - Preferences - Advanced you will see many User Agents to pick from under Internet Explorer (5) / Opera (2) / Chrome (1) / Firefox (6) / Safari (11) or you just paste the custom UA you want to use.

Qt Web Portable Browser

http://qtweb.net/

...

Edited December 22, 2013 by duffy98

[JorgeA]

@TELVM and @duffy98,

Thanks for the info on user agents. It looks like the technique applies to Firefox/Pale Moon but not to IE8; typing "about:config" in a new tab gives me a "Navigation Canceled" result.

I found some pages on the Web that give instructions on how to change the user agent in IE by going into "Developer Tools" (F12), but they work only in IE9 and not 8 which doesn't have a "change user agent" choice in that Tools submenu.

Am I out of luck?

--JorgeA

[JorgeA]

A relevant article, and a question:

Use of Tor helped FBI ID suspect in bomb hoax case

Tor can be an effective tool for staying anonymous, but not always. If the people you're trying to evade have access to your local network or your ISP's network, they can see that you're using Tor and can track the duration and other key details. The failure here wasn't on the part of Tor but rather on a user who didn't think through what he was trying to do. The episode helps underscore how Tor could be more effective if it were more widely used.

[emphasis added]

So, given that the spooks have (open or covert) access to every ISP in the USA (isn't that right?), doesn't this make Tor essentially useless for U.S.-based users?

--JorgeA

[Monroe]

JorgeA ... I can't be of much help with IE 8 ... I really don't fire it up very often, only to get my monthly XP updates. I use K-Meleon 1.6 as my main browser and Qt Web as a backup browser. I had Firefox and Opera also installed and removed them earlier today. Going to go with this setup for awhile. Still in learning mode with Qt Web.

This is my current UA that I just put into KM and Qt Web earlier today.

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:25.0) Gecko/20100101 Firefox/25.0.9.9

Browser: Firefox 25.0.9.9

Run on: Windows 7

Device: Personal computer

...

[TELVM]

@TELVM and @duffy98,

Thanks for the info on user agents. It looks like the technique applies to Firefox/Pale Moon but not to IE8; typing "about:config" in a new tab gives me a "Navigation Canceled" result.

I found some pages on the Web that give instructions on how to change the user agent in IE by going into "Developer Tools" (F12), but they work only in IE9 and not 8 which doesn't have a "change user agent" choice in that Tools submenu.

Am I out of luck?

--JorgeA

Are you really using IE Jorge?

And we don't even need IE for that!