Microsoft joining the Linux Foundation comes down to one word: Cloud

Microsoft Linux cloud 

By Jack Wallen  | November 23, 2016, 9:02 AM PST

It's been reported over and over and over again. Yes, Microsoft has joined the Linux Foundation. This is an event, a real, serious event; something not one pundit, analyst, or Linux user would have even remotely considered not even five years ago. But there it is.

Don't believe me? Here's the announcement in which Microsoft has joined the LF as a Platinum Member. Upon joining, Scott Guthrie, Executive Vice President of the Microsoft Cloud and Enterprise Group had this to say:

"As a cloud platform company we aim to help developers achieve more using the platforms and languages they know... The Linux Foundation is home not only to Linux, but many of the community's most innovative open source projects. We are excited to join The Linux Foundation and partner with the community to help developers capitalize on the shift to intelligent cloud and mobile experiences."

A more subtle shift

Shortly after this union, the Linux Foundation made a subtle shift in their convention scheduling. LinuxCon, CloudOpen, and ContainerCon will now be combined under one umbrella event: The Linux Foundation Open Source Summit. I'm not saying this change was done simply to accommodate Microsoft, but considering some of the marketing material has also shifted from focusing primarily on Linux to open source, you might be able to draw a conclusion or two. That conclusion, I believe, has been long overdue; that both the Linux Foundation and Microsoft are embracing one another not only speaks to the power of open source, but how the platform has become a major driving force in computing on all levels.

A perfect union

The Linux Foundation has been doing amazing work serving as a bridge between the open source community and the rest of the world — not just enterprise business, but end users, home office, small business, mid-sized businesses, and governments. They've fostered important relationships that have helped to drive innovation in ways that may not have been possible otherwise. The Linux Foundation has hundreds of members and thousands of projects (some of which have become essential to enterprise business); it makes perfect sense that Microsoft would not only want to get in on the action, but would truly need to be a part of this union. Why? One word. Cloud.

That's right, the "C" word.

It is no great secret that Linux owns the cloud. Even from the Microsoft perspective, nearly 1 in 3 Azure virtual machines are Linux. Amazon Web Services, Apache CloudStack, Rackspace, Google Cloud Platform, and OpenStack are all powered by Linux. That is a piece of pie Microsoft wants to get the tines of their fork into. And why shouldn't they? Cloud is the thing and cloud is going nowhere but up.

But this isn't a one-way street. Ten years ago, had this same thing happened, everyone would be crying foul that Microsoft was only in this for themselves. However, I see a different shade of humble happening from Redmond these days. Microsoft understands one very important thing: As the cloud succeeds, so too does Microsoft. That sentiment is amended with the idea that the cloud cannot, in any way, succeed without open source. So it is in the best interest of Microsoft to ensure that open source does, in fact, succeed.

What better way to see to this than to join the cause?

The shift in strategy

Microsoft, the once very closed company, now:

• Has open-sourced parts of its own .NET platform
• Purchased, and subsequently open-sourced, Xamarin
• Partnered with Canonical to bring Ubuntu to Windows
• Worked with FreeBSD to release an image for Azure
• Partnered with Redhat and SUSE to bring Linux to Azure
• Has become a leading contributor on Github
• Announced the porting of SQL server to Linux
• Offers its own Linux certification

Those feats cannot be ignored. The company now delivers and is not showing any signs of backing down from its promise to embrace and extend. This is the same company that was once run by a man who said Linux was a cancer. What we have witnessed, over the last few years, is nothing short of a tectonic shift in strategy on the part of Microsoft...one that can help to redefine the reach and power of open source for years to come.

We have come a long way, baby.

A sizable win-win

I cannot help but come back to the Linux Foundation. A lesser organization might have scoffed at Microsoft's advances, citing the years of FUD and damaging business practices. Fortunately, the Linux Foundation is bigger and better than that. They know bringing Microsoft into the fold is a huge win for them, for open source, and for the Redmond company itself. In fact, this is a sizable win-win for everyone, from end users to the biggest enterprise companies on the planet.

Thanks to the tireless work on the part of the Linux Foundation, open source has a juggernaut champion in its corner. That tectonic shift in the open source landscape is the beginning of a new world order for users, IT, and business.

How to get more from Windows Defender by using its command-line tool

windows defender icon

In the article Windows Defender: Past, present, and future, I told you that Windows Defender appears to be slated for a transition into a modern Windows app after years with a similar user interface. I also ran through some of the features in the most current version of Windows Defender.

After that article was published, I received a question from a reader who asked if I knew whether Windows Defender will still have a command-line version after it is converted into a Windows app. I checked with a couple of my sources and received three answers: Yes, No, and Maybe. The Yes and Maybe answers were based on the fact that there are some advanced operations you can only perform from the command line. Since it's really too early to speculate further, I'll just leave it at that for now. However, while I was running my informal survey, I discovered that a couple of my contacts were unaware that there was a command-line version of Windows Defender.

As such, I thought I would write an article covering how and why to run Windows Defender from the command line. Let take a look.

Accessing the command-line version

Since Windows Defender has a Windows UI and performs most of its operations in the background, you may be wondering why anyone would want to use it from the command line. Well, the truth is that the command-line version is useful in situations where you want to be able to automate and customize Windows Defender's standard operations. Furthermore, as I mentioned, there are some advanced operations you can only perform from the command line-version. You may not use some of those operations often, but it's nice to know that they are available.

To find the command-line version of Windows Defender, just open File Explorer and navigate to C:\Program Files\Windows Defender. When you get there, look for a file by the name of

MpCmdRun.exe

If you right-click on the file and access its properties, you'll see that the actual name of the tool is Microsoft Malware Protection Command Line Utility (Figure A). Thus, the strange filename.

Figure A

You can find the actual name of the tool by accessing the file's properties.

Performing standard operations

To use the command-line version of Windows Defender, you need to be in an Administrator Command Prompt. If you have been following along and have File Explorer open to the C:\Program Files\Windows Defender folder, all you have to do is pull down the File menu and select the Open Command Prompt As Administrator command, as shown in Figure B.

Figure B

You can open an Administrator Command Prompt from within File Explorer.

The command-line version is useful in situations where you want to automate and customize how and when Windows Defender is run. For example, if you want to run a quick scan, you'll use the command:

mpcmdrun -scan -scantype 1

If you want to run a full scan, you'll use the command:

mpcmdrun -scan -scantype 2

If you want to check for new virus signature definition updates, you'll use the command:

mpcmdrun -signatureupdate

Performing advanced operations

In addition to the standard types of operations, there are several other advanced operations you can only perform with the command-line version of Windows Defender. For instance, you can enable diagnostic tracing, remove certain signature definitions, scan specific folders, and just run a scan on the boot sector of your hard disk. Here are a few examples.

If you want to scan the Downloads folder, you'll use the command:

mpcmdrun -scan -scantype 3 -File C:\Users\{yourname}\Downloads

If you want to perform a boot sector scan, you'll use the command:

mpcmdrun -scan -bootsectorscan

If Windows Defender gets fouled up during a signature definition update, you can reset signature definitions using the command:

mpcmdrun -removedefinitions

You can then try the update again.

If Windows Defender isn't performing up to par, you can reset the settings using the command:

mpcmdrun -restoredefaults

Detailed help

You can get detailed information about these commands and other advanced Windows Defender command-line operations with the command:

mpcmdrun -?

Your Headphones Can Spy On You — Even If You Have Disabled Microphone

 Headphones mic

Wednesday, November 23, 2016 Swati Khandelwal

Have you considered the possibility that someone could be watching you through your webcam? Or Listening to all your conversations through your laptop’s microphone?


Even a bit of thought about this probability could make you feel incredibly creepy.

But most people think that they have a solution to these major issues i.e. simply covering their laptop’s webcam and microphone with tape, just like Facebook CEO Mark Zuckerberg and FBI Director James Comey.

But it's 2016, and a piece of tape won't help you, as a new experiment has proved that how easily hackers can turn your headphones into a microphone to spy on all your conversations in the background without your knowledge.

A group of Israeli security researchers at Ben Gurion University have created a proof-of-concept code (malware) that converts typical headphones into microphones and then use them to record all your conversations in the room just like a fully-featured spying device.


Speake(a)r Malware Weaponizes Headphones and Speakers
Using headphones as microphones is a decade-old technique. There are many videos available on YouTube, which show that earbuds can function as microphones in a pinch.

But what the researchers managed to do is switching an output channel of the audio card on your laptop — running either Windows or Mac OS — to an input signal and then recording the sound without any dedicated microphone channel from as far as 20 feet away.

Dubbed "Speake(a)r," the malicious code (malware) is disturbingly able to hijack a computer to record audio even when its microphone is disabled or completely disconnected from the computer.

"People don’t think about this privacy vulnerability," says lead researcher Mordechai Guri told Wired. "Even if you remove your computer’s microphone, if you use headphones you can be recorded."Speake(a)r actually utilizes the existing headphones to capture vibrations in the air, converts them to electromagnetic signals, alters the internal functions of audio jacks, and then flips input jacks (used by microphones) to output jacks (used for speakers and headphones).

This allows a hacker to record audio, though at a lower quality, from computers with disabled or no microphone or from computers of a paranoid user, who has intentionally ved any existing audio components.

But What made this Hack Possible?
Thanks to a little-known feature of Realtek audio codec chips that actually "retask" the computer's output channel as an input channel silently.

This makes it possible for the researchers' malware to record audio even when the earbuds is connected into an output-only jack and do not even have a microphone channel on their plug.

What's even worse? Since RealTek chips are being used on the majority of systems these days, the Speake(a)r attack works on practically any computer, running Windows or MacOS, and most laptops, as well, leaving most computers vulnerable to such attacks.

"This is the real vulnerability," said Guri. "It’s what makes almost every computer today vulnerable to this type of attack."The feature of RealTek audio codec chips is truly dangerous, as it can not be easily fixed. The only way to deal with this issue is to redesign and replace the chip in current as well as future computers, which is impractical.

Security researchers also published a YouTube video which shows the Speake(a)r eavesdropping attack in work.

For more detailed and technical explanation of the Speake(a)r attack, you can head on to the research paper [PDF] titled "Speake(a)r: Turn Speakers to Microphones for Fun and Profit."

Researchers Show How to Steal Tesla Car by Hacking into Owner's Smartphone

tesla car

Friday, November 25, 2016 Mohit Kumar



New technology is always a little scary, so are Smart Cars. From GPS system and satellite radio to wireless locks, steering, brakes, and accelerator, today vehicles are more connected to networks than ever, and so they are more hackable than ever.

It's not new for security researchers to hack connected cars. Previously they had demonstrated how to hijack a car remotely, and how to disable car's crucial functions like airbags by exploiting security bugs affecting significant automobiles.

Now this time, researchers at Norway-based security firm Promon have demonstrated how easy it is for hackers to steal Tesla cars through the company's official Android application that many car owners use to interact with their vehicle.



Two months ago, Chinese security researchers from Keen Lab managed to hack a Tesla Model S, which allowed them to control a car in both Parking and Driving Mode from 12 miles away.

However, Promon researchers have taken an entirely different approach.


Tesla Stores OAuth Token in Plaintext
The researchers infected a Tesla owner's phone with Android malware by compromising the Tesla's smartphone app, allowing them to locate, unlock and drive away with a Tesla Model S.

However, Tesla has clarified that the vulnerabilities used in the latest attack do not reside in its app, rather the attack employed known social engineering techniques that trick people into installing malware on their Android devices, which compromise their entire phone and all apps, including Tesla app.

In a blog post, Promon researchers explained that Tesla app generates an OAuth token when a Tesla owner log in to the Android app for the first time. The app then uses this token, without requiring the username and password every time the owner re-opens the app.



This OAuth token is then stored in plain text into the device’s system folder which can be accessed by privileged root user only.


Researchers Demonstrates How to Steal a Tesla Car:
According to researchers, it is easy for an attacker to develop a malicious app that contains Android rooting exploits such as Towelroot and Kingroot, which can then be used to escalate the malicious app's privileges, allowing attackers to read OAuth token from the Tesla app.

Stealing this token could enable an attacker to locate the car and open its doors, but could not help the attacker start and drive away with the owner's car.

For this, the malware needs to delete the OAuth token from the owner's phone, which prompts the owner to enter his/her username and password again, allowing the attacker to collect the owner's login credentials.

Researchers say this can be done by modifying the original Tesla app's source code. Since the malware has already rooted the owner's smartphone, it can alter the Tesla app and send a copy of the victim's username and password to the attacker.

With this data, the attacker can perform a series of actions, like locating the car on the road, open its doors, start the car's motor and drive the car away unhindered, just by sending well-crafted HTTP requests to the Tesla servers with the owner's OAuth token and password.

Tesla says it is not the issue with its product but common social engineering tricks used by attackers to first compromise victim's phone, rooting the device and then altering its apps data.

The researchers' attack is only possible when an attacker convinces a victim into downloading a malicious app on his/her Android device.

Trump Tower turns into ‘Dump Tower’ on Google Maps

Trump Tower turns

By tech2 News Staff /  27 Nov 2016 , 15:50

Trump Tower in New York city turned into “Dump Tower” on Google Maps for a few hours, and its proper name was restored on the mapping service by early Sunday morning.

The tower serves as President-elect Donald Trump’s home in Manhattan. Its central location on Fifth Avenue has posed security challenges for the Secret Service and local law enforcement, CNN reported.

According to CNN, the Trump International Hotel and Tower in Columbus Circle had also been renamed “Dump International Hotel and Tower” on Saturday.

By Sunday morning, that reference also had been removed.

Users of the mapping service began to notice the new name on Saturday, and some took to social media to report it.

Trump has not yet commented on it. He has been using the Trump Tower as his transition headquarters.

As of now it isn’t clear as to who or what caused the changes. Google’s Map Maker, which allows anyone to make changes to the geography of the map, is available in more than 45 countries including India. The company re-opened this service after the controversial prank had taken place in May where an Android logo was sported peeing on the Apple logo in Google Maps.

The earlier this month, Google said that it will be shutting down the app and that it will integrate it into Maps app by next year.

With inputs from IANS

Oppo A57 launched in China: 16MP selfie camera, Snapdragon 435 chipset and more

Oppo A57

By tech2 News Staff /  27 Nov 2016 , 10:42

Oppo has launched its all new A57 selfie smartphone in its home market, China. The new smartphone packs in new and updated hardware along with a 16MP selfie camera and will go on sale in China on 12 December for CNY 1,599 (roughly Rs 16,000).

The design is similar to smartphones from Oppo that are currently available in the market like the F1 Plus and the F1s. It features a rounded design almost non-existent antenna lines, hinting that it could be made of plastic and not metal (keeping the price in mind).

There’s a 5.2-inch HD LCD display that features a 2.5D glass screen for protection. Inside, we get a Qualcomm Snapdragon 435 clocked at 1.4GHz with a 505GPU to handle graphics. There’s 3GB RAM and 32GB storage which can be expanded via a microSD card slot (up to 128GB).

Coming to the cameras, Oppo offers a 16MP front-facing camera up front and a 13MP camera with PDAF on the rear-side.  There’s a static home button on the front which also features a fingerprint reader inside.

Connectivity options include, 4G LTE radios, Bluetooth v4.1, Wi-Fi, and a USB port placed at the bottom of the handset. A 2,900mAh battery completes the package.

If you haven’t noticed by now, the Oppo A57 comes pretty close to the recently announcedVivo V5. While the Vivo V5 competes with Oppo’s F1s smartphone in India, an upgrade to a Snapdragon 435 could do wonders for Oppo, considering that the V5 packs in a 20MP selfie camera. Oppo recently upgraded it F1s with 4GB RAM and 64GB storage.

Android 7.1.1 Nougat update for Nexus 6P could release on 6 December

Android 7.1.1 Nougat update

By tech2 News Staff / 27 Nov 2016 , 13:55

According to a telecom operator, Google could be looking to release Android 7.1.1 in early December. Vodafone Australia has put out a page on its website to help Nexus 6P owners prepare their smartphones for the upcoming update. The same webpage also mentions a date for the Android 7.1.1’s arrival and so far, it has been set for 6 December.

Yes, owners of the Nexus 6P can rejoice considering that this is indeed concrete information coming from a worldwide telecom operator. It specifically mentions the Android version and the exact date along with details as to how Nexus 6P owners can prepare their smartphones, download and install the update. But there are some more details about how the update will be rolled out.

Like with all things Google, the update will be rolled out progressively. From days 1-3 only 10,000 phones are selected at random to be eligible for the update and their owners will be alerted via FOTA Push Message or will need to manually check for the same from the Settings menu.

From day 4-13, an additional 10 percent of owners will qualify for the update and this would depend upon users as they would need to manually check to receive the same.

From day 14 all devices will become eligible to receive the update. So for those who cannot wait, it is wise to keep checking so that your handset qualifies for the limited selection.

The update packs in Android security patch level for 5 December 2016. The build number as per the website is NMF26F. The update is said to be approximately 650MB in size.

Back in October, Google had made official in its developer blog that its Android 7.1.1 update for Nexus devices will be rolled out in the month of December.