android-bug-exposed covid-19-contact-tracing-logs-to-preinstalled-apps

Android bug exposed COVID-19 contact tracing logs to preinstalled apps

The Android version of Google and Apple’s COVID-19 exposure notification app had a privacy flaw that let other preinstalled apps potentially see sensitive data, including if someone had been in contact with a person who tested positive for COVID-19, privacy analysis firm AppCensus revealed on Tuesday. Google says it’s currently rolling out a fix to the bug.

The bug cuts against repeated promises from Google CEO Sundar Pichai, Apple CEO Tim Cook, and numerous public health officials that the data collected by the exposure notification program could not be shared outside of a person’s device.

AppCensus first reported the vulnerability to Google in February, but the company failed to address it, The Markup reported. Fixing the issue would be as simple as deleting a few nonessential lines of code, Joel Reardon, co-founder and forensics lead of AppCensus, told The Markup. “It’s such an obvious fix, and I was flabbergasted that it wasn’t seen as that,” Reardon said.

Updates to address the issue are “ongoing,” Google spokesperson José Castañeda said in an emailed statement to The Markup. “We were notified of an issue where the Bluetooth identifiers were temporarily accessible to specific system level applications for debugging purposes, and we immediately started rolling out a fix to address this,” he said.

The exposure notification system works by pinging anonymized Bluetooth signals between a user’s phone and other phones that have the system activated. Then, if someone using the app tests positive for COVID-19, they can work with health authorities to send an alert to any phones with corresponding signals logged in the phone’s memory.

On Android phones, the contract tracing data is logged in privileged system memory, where it’s inaccessible to most software running on the phone. But apps that are preinstalled by manufacturers get special system privileges that would let them access those logs, putting sensitive contact-tracing data at risk. There is no indication any apps have actually collected that data at this point, Reardon said.

Preinstalled apps have taken advantage of their special permissions before — other investigations show that they sometimes harvest data like geolocation information and phone contacts.

The analysis did not find any similar issues with the exposure notification system on iPhone.

The problem is an implementation issue and not inherent to the exposure notification framework, Serge Egelman, the chief technology officer at AppCensus, said in a statement posted on Twitter. It should not erode trust in public health technologies. “We hope the lesson here is that getting privacy right is really hard, vulnerabilities will always be discovered in systems, but that it’s in everyone’s interest to work together to remediate these issues,” Egelman said.

apple-will-reportedly-face-eu-antitrust-charges-this-week

Apple will reportedly face EU antitrust charges this week

The European Commission will issue antitrust charges against Apple over concerns about the company’s App Store practices, according to a report from the Financial Times. The commission has been investigating whether Apple has broken EU competition rules with its App Store policies, following an initial complaint from Spotify back in 2019 over Apple’s 30 percent cut on subscriptions.

The European Commission opened up two antitrust investigations into Apple’s App Store and Apple Pay practices last year, and the Financial Times only mentions upcoming charges on the App Store case. It’s not clear yet what action will be taken.

Spotify has previously claimed Apple uses its App Store to stifle innovation and limit consumer choice in favor of its own Apple Music service. Rakuten filed a similar complaint to the EU last year, alleging that it’s anti-competitive for Apple to take a 30 percent commission on ebooks sold through the App Store while promoting its own Apple Books service.

Known as the “Apple tax,” this 30 percent cut has long been targeted by companies like Netflix and Spotify. Apple has defended its policies, arguing that the revenue it earns contributes toward the costs of maintaining the App Store and enforcing its content, privacy, and security guidelines.

Epic Games also filed an antitrust complaint with the EU earlier this year, as part of its ongoing dispute with Apple. The Fortnite developer has publicly criticized Apple’s App Store policies around distribution and payments, resulting in Epic attempting to circumvent Apple’s 30 percent cut on in-app purchases in Fortnite. Apple quickly removed the game from its App Store, and a legal battle is now in progress.

Despite Apple’s defense of its App Store, the iPhone-maker has already sought to ease pressure from regulators and developers with App Store policy changes over the past year. Apple now lets some video streaming apps bypass the App Store cut, and it has reduced its App Store commission rate to 15 percent for any developer that earns less than $1 million in annual revenue.

These changes alone haven’t been enough to ease the fears of EU regulators if the report from the Financial Times is accurate, and we’ll now find out later this week exactly how the European Union will respond to one of the United States’ biggest tech companies.

apple-will-now-let-you-add-virtual-lasers-and-confetti-to-your-clips-videos

Apple will now let you add virtual lasers and confetti to your Clips videos

Apple now lets you add augmented-reality lasers, confetti, and more to your Clips videos, thanks to an update to the short-form video app. The feature, called AR Spaces, will let users with LIDAR-equipped Apple devices (so far, that’s the iPhone 12 Pros and iPad Pros from 2020 or later) add room-filling effects that can interact with walls and floors. (If you watched Apple’s April 20th event, you may have spotted a brief look at the update ahead of today’s release.)

You can get an idea of what this will look like in action with this GIF taken from Apple’s demo video.

The Prism and Dance Floor effects.
Image: Apple

Apple says that the AR Spaces effects should work with the other effects built in to Clips, such as the animated stickers and emoji, if you want to add even more to your videos. The update to the app can be downloaded now from the App Store.

The Clips update is Apple’s latest experiment with AR, in which the company has a keen interest. The company released an AR experience tie-in for its show For All Mankind in February, and CEO Tim Cook discussed some of his thoughts about AR tech in an interview earlier this month. There are also rumors that Apple is working on a full-fledged AR / VR headset.

mobee-k’s-new-smart-usb-c-headphones-come-preloaded-with-deezer

Mobee-K’s new smart USB-C headphones come preloaded with Deezer

(Image credit: Deezer)

For years, it’s been customary for video streaming services to come built into TVs, but this is the first time we’ve seen a music streaming service built into a pair of headphones.

The Mobee-K Smart Earphones side load Deezer onto compatible Samsung Galaxy smartphones like the S21, Note 20 Ultra or Z Flip when connected via USB-C. They also grant the listener three months of free Deezer HiFi or Deezer Premium.

Plug them in, and the headphones unlock a customised Deezer theme with exclusive content, including wallpapers, exclusive playlists, and shortcuts to Deezer, which can be accessed via the phone’s lock screen and home screen menus.

You can still use the headphones with other USB-C devices, but you won’t get the extras without a Samsung Galaxy device. You’ll also have to download Deezer the normal way, via the Google Play Store.

The Mobee-K Smart Earphones only cost $22 and are available exclusively on Amazon. Not convinced by this budget offering? Perhaps consider a pair from our list of the best earbuds you can buy.

MORE:

Cut the cord with the best wireless earbuds around

Apple fan? Check out the best iPhone headphones

And these are the best headphones of all types, for all budgets