Chinese researchers have discovered a vulnerability in voice assistants from Apple, Google, Amazon, Microsoft, Samsung, and Huawei. It affects every iPhone and Macbook running Siri, any Galaxy phone, any PC running Windows 10, and even Amazon's Alexa assistant. From a report: Using a technique called the DolphinAttack, a team from Zhejiang University translated typical vocal commands into ultrasonic frequencies that are too high for the human ear to hear, but perfectly decipherable by the microphones and software powering our always-on voice assistants. This relatively simple translation process lets them take control of gadgets with just a few words uttered in frequencies none of us can hear. The researchers didn't just activate basic commands like "Hey Siri" or "Okay Google," though. They could also tell an iPhone to "call 1234567890" or tell an iPad to FaceTime the number. They could force a Macbook or a Nexus 7 to open a malicious website. They could order an Amazon Echo to "open the backdoor." Even an Audi Q3 could have its navigation system redirected to a new location. "Inaudible voice commands question the common design assumption that adversaries may at most try to manipulate a [voice assistant] vocally and can be detected by an alert user," the research team writes in a paper just accepted to the ACM Conference on Computer and Communications Security.

An anonymous reader writes from a report via Bleeping Computer: An attacker can downgrade components of the Android TrustZone technology -- a secure section of smartphone CPUs -- to older versions that feature known vulnerabilities. The attacker can then use previously published exploit code to attack up-to-date Android OS versions. The research team proved their attack in tests on devices running the ARM TrustZone technology, such as Samsung Galaxy S7, Huawei Mate 9, Google Nexus 5, and Google Nexus 6. They replaced updated versions of the Widevine trustlet with an older version that was vulnerable to CVE-2015-6639, a vulnerability in Android's Qualcomm Secure Execution Environment (QSEE) -- Qualcomm's name for its ARM TrustZone version that runs on Qualcomm chips. This vulnerability allows attackers root level access to the TrustZone OS, which indirectly grants the attack control over the entire phone. The research paper is available here, and one of the researcher's authors explains the attack chain in an interview here.

New submitter mirandakatz writes: Katie Hafner has spent the last 23 days in rehab. Not for alcoholism or gambling, but for a self-inflicted case of episodic partial attention thanks to her iPhone. On Backchannel, Hafner writes about the detrimental effect the constant stream of pings has had on her, and how her life has come to resemble a computer screen. "I sense a constant agitation when I'm doing something," she says, "as if there is something else out there, beckoning -- demanding -- my attention. And nothing needs to be deferred." "I blame electronics for my affliction," writes Hafner, who says the devices in her life "teem with squirrels." "If I pick up my iPhone to send a text, damned if I don't get knocked off task within a couple of seconds by an alert about Trump's latest tweet. And my guess is that if you have allowed your mind to be as tyrannized by the demands of your devices as I have, you too suffer to some degree from this condition."

Hafner goes on to describe her symptoms of "episodic partial attention" and provide potential fixes for it: "There are the obvious fixes. Address the electronics first: Silence the phone as well as all alerts on your computer, and you automatically banish two squirrels. But how do you shut down the micro-distractions that dangle everywhere in your physical world, their bushy gray tails twitching seductively? My therapy, of my own devising, consists of serial mono-tasking with a big dose of mindful intent, or intentional mindfulness -- which is really just good, old-fashioned paying attention. At first, I took the tiniest of steps. I celebrated the buttoning of a blouse without stopping to apply the hand cream I spotted on the dresser as if I had gotten into Harvard. Each task I took on -- however mundane -- I had to first announce, quietly, to myself. I made myself vow that I would work on that task and only that task until it was finished. Like a stroke patient relearning how to move an arm, I told myself not that I was making the entire bed (too overwhelming), but that I had a series of steps to perform: first the top sheet, then the blankets, then the comforter, then the pillows. Emptying the dishwasher became my Waterloo. Putting dishes away takes time, and it's tedious. Perhaps the greatest challenge lies in the fact that the job requires repeated kitchen crossings. There are squirrels everywhere, none more treacherous than the siren song that is my iPhone."

An anonymous reader quotes a report from Mac Rumors: Investigators for Major League Baseball believe the Boston Red Sox, currently in first place in the American League East, have used the Apple Watch to illicitly steal hand signals from opposing teams, reports The New York Times. The Red Sox are believed to have stolen hand signals from opponents' catchers in games using video recording equipment and communicated the information with the Apple Watch. An inquiry into the Red Sox' practice started two weeks ago following a complaint from Yankees general manager Brian Cashman, who caught a member of the Red Sox training staff looking at his Apple Watch in the dugout and then relaying information to players. It's believed the information was used to determine the type of pitch that was going to be thrown. Baseball investigators corroborated the claim using video for instant replay and broadcasts before confronting the Red Sox. The team admitted that trainers received signals from video replay personnel and then shared them with some players.

"The Red Sox told league investigators said that team personnel scanning instant- replay video were electronically sending the pitch signs to the trainers, who were then passing the information to the players," reports The New York Times. [...] "The video provided to the commissioner's office by the Yankees was captured during the first two games of the series and included at least three clips. In the clips, the team's assistant athletic trainer, Jon Jochim, is seen looking at his Apple Watch and then passing information to outfielder Brock Holt and second baseman Dustin Pedroia, who was injured at the time but in uniform. In one instance, Pedroia is then seen passing the information to Young."

An anonymous reader writes: Android bootloader components from five major chipset vendors are affected by vulnerabilities that break the CoT (Chain of Trust) during the Android OS boot-up sequence, opening devices to attacks. The vulnerabilities were discovered with a new tool called BootStomp, developed by nine computer scientists from the University of California, Santa Barbara. Researchers analyzed five bootloaders from four vendors (NVIDIA, Qualcomm, MediaTek, and Huawei/HiSilicon). Using BootStomp, researchers identified seven security flaws, six new and one previously known (CVE-2014-9798). Of the six new flaws, bootloader vendors already acknowledged five and are working on a fix. "Some of these vulnerabilities would allow an attacker to execute arbitrary code as part of the bootloader (thus compromising the entire chain of trust), or to perform permanent denial-of-service attacks," the research team said (PDF). "Our tool also identified two bootloader vulnerabilities that can be leveraged by an attacker with root privileges on the OS to unlock the device and break the CoT."

Mark Wilson shares a report from BetaNews: As is easy to tell by comparing versions of Android from different handset manufacturers, developers are -- broadly speaking -- free to do whatever they want with Android, but with Oreo, one aspect of this is changing. Google is introducing a new requirement that OEMs must meet certain requirements when choosing the Linux kernel they use. Until now, as pointed out by XDA Developers, OEMs have been free to use whatever Linux kernel they wanted to create their own version of Android. Of course, their builds still had to pass Google's other tests, but the kernel number itself was not an issue. Moving forward, Android devices running Oreo must use at least kernel 3.18, but there are more specific requirements to meet as well. Google explains on the Android Source page: "Android O mandates a minimum kernel version and kernel configuration and checks them both in VTS as well as during an OTA. Android device kernels must enable the kernel .config support along with the option to read the kernel configuration at runtime through procfs."

An anonymous reader quotes a report from Salon: Released in 2009 by Palm -- the same company that popularized the PDA in the 1990s -- WebOS pioneered a number of innovations, including multiple synchronized calendars, unified social media and contact management, curved displays, wireless charging, integrated text and Web messaging, and unintrusive notifications [that have all been copied by the mobile operating systems that defeated it on the marketplace]. The operating system, built on top of a Linux kernel, was also legendary for how easily it could be upgraded by users with programming skills. WebOS was also special in that it used native internet technologies like JavaScript for local applications. That was a huge part of why it was able to do so much integration with Web services, something its competitors at the time simply couldn't match.

Apple's upcoming iOS 11 once again demonstrates how far ahead of its time WebOS really was. The yet-to-be-released Apple mobile system has essentially copied the WebOS model for switching apps by having the user swipe upward from the bottom to reveal several "cards" that represent background applications. While Apple's decision to remove its massively overworked Home button is an improvement, it is still an inferior way of switching apps, compared to what you could do on WebOS eight years ago.

On Saturday, Chinese mobile maker Huawei unveiled its first artificial intelligence smartphone chipset, which it hopes will lure customers away from Apple's upcoming range of new iPhones and towards the Asian company's "most powerful handset yet," the Mate 10, which is set to debut next month. Mac Rumors reports: Huawei touted the Kirin 970 AI mobile chipset's built-in "neural processing unit" at the IFA consumer electronics trade show in Berlin, claiming that the technology is "20 times faster" than a traditional processor. The world's third largest smartphone maker claimed that mobile devices powered by the Kirin 970 will be able to "truly know and understand their users," by supporting real-time image recognition, voice interaction, and intelligent photography with ease. According to Nikkei, the Kirin 970 integrates 5.5 billion transistors in a single square centimeter about the size of a thumbnail, which includes an octa-core central processing unit, a 12-core graphics processing unit, a dual-image signal processor, a high-speed 1.2Gbps Cat.18 modem, and AI mobile computing architecture. The Kirin 970 is said to be based on the same 10-nanometer technology as Apple's existing A10X Fusion processor and the A11 processor that will power its new iPhone range, set to debut this month. The Mate 10 is said to be a bezel-less all-screen handset with a 6-inch, 2:1 display and a 2,160 x 1,080 resolution. Like Apple's so-called "iPhone 8," the Mate 10 is also expected to feature some form of facial recognition and improved cameras.

There are many different ways to navigate a smartphone. Some devices employ capacitive touch navigation buttons in favor of on-screen navigation buttons for the back, home and overview commands. Others, such as the recently released Moto Z2 Force and Moto Z2 Play, feature a mini trackpad under the display that lets users navigate their device through a series of swipes (on-screen navigation buttons are used by default, but the option to use the "one button nav" mini trackpad can be enabled in the settings). The upcoming iPhone 8, for example, may feature a software bar in lieu of a physical/virtual home button, introducing new gesture controls for returning to the home screen and switching between apps.

How do you navigate your smartphone? Given the many different options available on the market, do you think there is one method of navigation that trumps the others, or is it a classic case of "different strokes for different folks?"

At a press conference in Berlin, LG announced their newest flagship smartphone, the LG V30. The V30 doesn't feature a removable battery or a secondary display like its predecessor, but it does feature faster performance and a significantly redesigned build construction that puts in more in line with Samsung and Apple's offerings. PhoneDog reports: A bigger device with beefier specs, the LG's V series took more design cues from the G series this year more than ever. As expected, LG got rid of the secondary display in favor of a single 6-inch LG P-OLED display (not Super AMOLED, although practically the same with rich black and vibrant colors). The V30 switches out its secondary display for slimmer bezels, which may prove to be a smart move considering how popular the concept is this year. Specs look pretty solid, although there were reports that the device would feature 6GB of RAM rather than 4GB. The bread and butter of the V30 are its sophisticated audio and its dual rear camera set-up. Speaking of the back of the device, another small advantage that LG may have over the competition is the center placement of its rear fingerprint sensor, which has been a bit of a pain point for Samsung this year with the S8 and the Note 8. The LG V30 is set to release on September 21 in South Korea, with releases in North America, Asia, Africa, and Europe following shortly after. LG also has yet to announce a price for the V30, although rumors peg it to be around 800,000 KRW in South Korea (which equates to about $699 in the U.S.). For those interested, GSMArena has a full spec sheet available for the LG V30. Some of the noteworthy specs include a 6-inch LG P-OLED display with an 18:9 aspect ratio and QHD (1440 x 2880) resolution, Snapdragon 835 processor with 4GB RAM, dual 16-megapixel/13-megapixel rear-facing camera sensors, headphone jack, 32-bit/192kHz audio, wireless charging and Android 7.1.2 Nougat.

Uber is revamping privacy settings that it rolled out last fall to allow iOS users the ability to deny Uber the right to track your whereabouts. Similar tweaks are reportedly coming to the Android version of the app. USA Today reports: The new options for Uber app users are: Always (Uber is allowed to collect rider location information from the moment the app is opened until the trip ends), While Using The App (information flows to Uber while the app is visible on the screen) and Never (no info is transmitted but riders have to manually input their pick-up and drop-off locations). One of the old privacy features that gave many users pause was Uber's ability to track the whereabouts of riders up to 5 minutes after a ride was completed. Uber says the 5-minute feature was never activated on the iOS version of its app, and that it was disabled a few months after being initiated on the Android version. The company maintained that the feature was to enhance safety, but for many the option was too reminiscent of some of Uber's more notorious Big Brother tactics.

In 2016, Uber settled an investigation brought by New York's attorney general by agreeing to encrypt rider geo-location. The inquiry was sparked by reports that Uber executives had access to riders' locations, and that Uber displayed rider information in an aerial view known internally as "God View." Earlier this year, federal regulators began investigating an Uber practice known as "greyballing," which allowed engineers to take over an app and create a screen showing cars that did not really exist. The practice was used to steer regulators investigating Uber away from drivers, and was halted by Uber after being reported by The New York Times.

According to a new report, TCL will be manufacturing palm-branded devices next year. SlashGear reports: The Palm brand has been in limbo for the past half-decade, moving in and out of HP-connected devices then on into relative obscurity. The Palm operating system was acquired by LG and continues to be used (in some form or another) in LG smart TVs to this day -- as such, it won't be coming with the Palm phone set for next year. On the day when gesture controls for the next iPhone just started to look like the last phone version of Palm OS, word appears of Palm's resurgence. Sadly, this resurgence almost certainly wont include Palm OS. Word comes from Android Planet that TCL Marketing Manager Stefan Streit confirmed that they've finally gotten to a place where they can make a Palm phone. TCL acquired the Palm brand all the way back in 2011.

An anonymous reader writes: The biggest benefit with a lease program is you have the option of upgrading to a newer phone model, usually after just a year. You don't get that option when you buy. But with a lease program, although it may be cheaper, you have to return the phone at the end of the agreement or when you upgrade -- meaning you can't pass it off to your child or sell it. So rather than leasing, buying may be a better option. But a New York Times column makes case for why leasing is the right way to go about it. I wanted to check with Slashdot readers, what do you prefer and why?

The New York City Police Department says it will give up its 36,000 Windows phones and transition to iPhones by the end of the year. The Verge reports: The switch is prompted in part by news in July that Microsoft was ending support for Windows Phone 8.1, which a large percentage of all Windows-powered phones are still using. It's a predictable end to the Windows phone, considering that its market share had already slipped below 1 percent at the time the police department adopted its phones last year. The ill-fated decision to go with the Windows phone was made solely by its NYPD deputy commissioner for IT, according to The New York Post, and apparently did not receive further judgment before implementing the program. The Windows models were Nokia Lumia 830 and Lumia 640 XL, equipped with special 911 apps, case management apps, and the ability to receive assignments. They were purchased as part of a $160 million initiative to modernize the NYPD, which has been around since 1845. The new business for Microsoft's phones was clearly not enough to keep Windows Phone alive.

According to CNBC, Apple will host its big iPhone 8 product launch event on September 12th. From the report: The tech giant is expected to announce a bevy of products, including two new iterative iPhone updates, possibly named the iPhone 7s and iPhone 7s Plus, in addition to a high-end iPhone 8. Apple is also reportedly gearing up to announce a new 4K Apple TV that will support sharper content than current models, and a new Apple Watch. The iPhone 8 will reportedly feature a display that takes up almost the entire front of the device, using new OLED panels that are brighter and more colorful than previous screens. Rumor has it Apple has moved the fingerprint reader to the back of the phone but will also support facial recognition thanks to a new 3-D sensor on the front of the device. Rumors have suggested the most high-end iPhone 8 will start at $1,000. Apple typically sells its new phones within a week or so of the announcement.

An anonymous reader shares a report: Sarahah, a new app that lets people sign up to receive anonymized, candid messages, has been surging in popularity; somewhere north of 18 million people are estimated to have downloaded it from Apple and Google's online stores, making it the No. 3 most downloaded free software title for iPhones and iPads. Sarahah bills itself as a way to "receive honest feedback" from friends and employees. But the app is collecting more than just feedback messages. When launched for the first time, it immediately harvests and uploads all phone numbers and email addresses in your address book. Although Sarahah does in some cases ask for permission to access contacts, it does not disclose that it uploads such data, nor does it seem to make any functional use of the information. Zachary Julian, a senior security analyst at Bishop Fox, discovered Sarahah is uploading of private information when he installed the app on his Android phone, a Galaxy S5 running Android 5.1.1. The phone was outfitted with monitoring software, known as Burp Suite, which intercepts internet traffic entering and leaving the device, allowing the owner to see what data is sent to remote servers. When Julian launched Sarahah on the device, Burp Suite caught the app in the act of uploading his private data.

An anonymous reader quotes the AP: Britain is set to conduct road trials of self-driving trucks, involving a "platoon" of vehicles controlled by a driver in the front. The Department for Transport said Friday that up to three trucks will travel in convoy, connected by Wi-Fi and with braking and acceleration controlled by the lead vehicle. Officials say the formation saves fuel and reduces carbon emissions, because the lead truck pushes air out of the way, making the others more efficient.

Today comScore released its 2017 US Mobile App Report, which among other things, lists the top mobile apps in the nation. From a report: Between smartphones and tablets, Americans spend more than half of their digital media consumption time -- 57 percent -- in apps, according to the report. That's about the same as a year ago -- evidence that the dramatic shift to mobile has now leveled out in the U.S. These are the winners, according to comScore, as measured by their penetration of the U.S. mobile app audience: Facebook (81 percent), YouTube (71 percent), Facebook Messenger (68 percent), Google Search (61 percent), Google Maps (57 percent), Instagram (50 percent), Snapchat (50 percent), Google Play (47 percent), Gmail (44 percent), and Pandora (41 percent). 8 out of 10 apps here are owned by Facebook and Google.

Engineers have figured out how to make antennas for wireless communication 100 times smaller than their current size, an advance that could lead to tiny brain implants, micro-medical devices, or phones you can wear on your finger. Science Magazine reports: The new mini-antennas play off the difference between electromagnetic (EM) waves, such as light and radio waves, and acoustic waves, such as sound and inaudible vibrations. EM waves are fluctuations in an electromagnetic field, and they travel at light speed -- an astounding 300,000,000 meters per second. Acoustic waves are the jiggling of matter, and they travel at the much slower speed of sound -- in a solid, typically a few thousand meters per second. So, at any given frequency, an EM wave has a much longer wavelength than an acoustic wave. Antennas receive information by resonating with EM waves, which they convert into electrical voltage. For such resonance to occur, a traditional antenna's length must roughly match the wavelength of the EM wave it receives, meaning that the antenna must be relatively big. However, like a guitar string, an antenna can also resonate with acoustic waves. The new antennas take advantage of this fact. They will pick up EM waves of a given frequency if its size matches the wavelength of the much shorter acoustic waves of the same frequency. That means that that for any given signal frequency, the antennas can be much smaller. The trick is, of course, to quickly turn the incoming EM waves into acoustic waves.

The team created two kinds of acoustic antennas. One has a circular membrane, which works for frequencies in the gigahertz range, including those for WiFi. The other has a rectangular membrane, suitable for megahertz frequencies used for TV and radio. Each is less than a millimeter across, and both can be manufactured together on a single chip. When researchers tested one of the antennas in a specially insulated room, they found that compared to a conventional ring antenna of the same size, it sent and received 2.5 gigahertz signals about 100,000 times more efficiently, they report in Nature Communications.

Yesterday, Android O officially became Android Oreo and started rolling out to Pixel and Nexus devices. While there are many new features available in the new OS, we thought we'd ask you: what are your favorite Android Oreo features? The Hacker News highlights eleven of the new features "that make Android even better" in their report: 1. No More 'Install From Unknown Sources' Setting: Prior to Android Oreo, third-party app installation requires users to enable just one setting by turning on "Install from unknown sources" -- doesn't matter from where the user has downloaded an APK file, i.e. from a browser, Bluetooth, transferred from a computer via USB or downloaded using another app. Android 8.0 Oreo has completely changed the way this feature works, bringing a much smarter and safer system called "Install other apps," in which a user has to manually permit 3rd-party app installation from different sources.
2. Autofill API Framework: Android 8.0 Oreo brings a built-in secure AutoFill API that allows users-chosen password manager to store different types of sensitive data, such as passwords, credit card numbers, phone numbers, and addresses -- and works throughout the entire system.
3. Picture-in-Picture: With Android Oreo, you can view a YouTube video while reading through a report in Word or be chatting on WhatsApp on your Android device -- thanks to Picture-in-Picture (PIP) feature.
4. Google Play Protect: Play Protect helps in detecting and removing harmful applications with more than 50 billion apps scanned every day.
5. Wi-Fi Aware (Neighborhood Aware Networking -- NAN): Android Oreo has added support for a new connectivity feature called Wi-Fi Aware, also known as Neighborhood Aware Networking (NAN), which allows apps and devices to automatically find, connect to, and share data with each other directly without any internet access point or cellular data.
6. Android Instant Apps: With Android 8.0 Oreo, you can now access a range of Instant Apps without downloading them.
7. Battery-Saving Background Limits: Google has blocked apps from reacting to "implicit broadcasts" and carrying out certain tasks when they are running in the background in an effort to enhance the battery life of Android device. Besides this, Android Oreo will also limit some background services and location updates when an app is not in use.
8. AI-based Smart Text Selection: Android Oreo brings the 'Smart Text Selection' feature, which uses Google's machine learning to detect when something like physical addresses, email addresses, names or phone numbers is selected, then automatically suggests the relevant information on other apps.
9. Notification Dots (Limit notifications): Oreo introduces Notification Dots that offers you to manage each app individually with "fine-grained control," allowing you to control how many notifications you see and how they come through.
10. Find my Device: Google has introduced a new feature, called Find my Device, which is a similar feature to Apple's Find my iPhone and allows people to locate, lock and wipe their Android devices in the event when they go missing or get stolen.
11. New Emoji and Downloadable Fonts: Android Oreo introduces 60 new emoji and a redesign of the current "blob" characters. The update also offers new color support to app developers and the ability to change or animate the shape of icons in their apps.