File-Based Encryption Vulnerability Reported by DeesTroy is Fixed in May’s Security Update

With the introduction of Android 7.0 Nougat, Google switched to a file-based encryption method instead of the full disk encryption that we were using in Marshmallow. There are benefits and drawbacks to each of these methods, but Google's security team felt Android was better suited using file-based encryption due to the level of hardware most flagship smartphones are shipping with these days. While this does make some things more secure, there were some remnants laying around that were not updated.

Specifically, there was a device_policies.xml file in /data/system/ that contained stats about your password. This included information such as the active quality of the password, how long it was, and how many uppercase, lowercase, numbers, symbols and special characters were present. So while it didn't exactly give away your password, a hacker who knew this type of information would have an easier time trying to brute force into the device than without it.

On devices with full disk encryption, this file was only accessible after you had entered your PIN, pattern or password successfully. However, this changes completely when a device is using a file-based encryption system. With a phone using file-based encryption, that file is readily accessible after completing the password-less Device Encryption process. DeesTroy from the TWRP fame discovered this back in November while tinkering with a Nexus 5X before they began TWRP development on the Pixel phone.

Yesterday, Google published the details for May's security update and this vulnerability has finally been patched up in the AOSP code. You can find details about the specific patch here and see that Google had rated the vulnerability as moderate. This was due to the fact that while it didn't give away the password, it did make it easier for an attacker to bypass the lock screen after a successful brute force attack.

Source: +DeesTroy

from xda-developers http://ift.tt/2p1ZJwW
via IFTTT

Beat.Me is an Arcade Shooter Game Which Uses Music to Create Game Levels

XDA Member NFSS10's Beat.Me is an arcade shooter where you play on levels which are generated according to the music on your device. Check it out!

from xda-developers http://ift.tt/2p1Mi10
via IFTTT

Samsung has Launched Bixby’s Voice Command Service in South Korea

Samsung's Bixby virtual assistant has been received with mixed emotions. Many enthusiasts want to distance themselves from the new feature but there are some within the community who have been looking forward to using its many features.

The situation has been made worse with how Samsung has been handling all Bixby-related topics since the Galaxy S8 and Galaxy S8+ was announced.

A lot of people were happy when it was revealed we could remap the dedicated Bixby button with standard hardware button remapping applications. This didn't last long though as the company rolled out an OTA update that removed this functionality with the remapping applications we're used to. Thankfully there are still ways to workaround this but it shows how hard Samsung is pushing back on the community with this, even though the remapping methods could have co-existed with Bixby.

There was even an issue with Verizon branded Galaxy S8 units not having its Bixby Vision feature working with Amazon the way it was advertised.

However, the biggest talking point was likely that Bixby's voice command service wasn't going to be made available at launch. They still aren't ready to roll out the service around the world but at least now they're making some progress. It is being reported that Galaxy S8 and S8+ units in South Korea are now able to use Bixby's voice command feature and associated functionality.

Samsung hasn't announced when the voice command service would be available to Galaxy S8 and S8+ owners that are not in South Korea. Previous reports have pegged this month as a possible launch period, but nothing has been made official just yet. Samsung says they just needed extra time to fully prepare their servers before the feature was to be rolled out to their customers.

Many hoped issues would be ironed out by launch but it makes sense for Samsung to not want people getting a bad first impression of the new service. A few would still argue that Samsung oversold Bixby at its launch. What do you think?

Source: ZDNet

from xda-developers http://ift.tt/2poVuiF
via IFTTT

Install the Official MIUI Screen Recorder App on MIUI Global ROMs

The Beta versions of MIUI are shipping with their own Screen Recorder app. By following XDA Member Paclanc's instructions, you can install the same on MIUI Global ROMs as well.

from xda-developers http://ift.tt/2oZ4t6v
via IFTTT

Android Security Bulletin Released for May 2017; Security Update Rolling Out to Supported Pixel and Nexus Devices

Right on schedule, Google has released the Android Security Bulletin for this month along with updated security patches for recently discovered vulnerabilities. This month's security update includes fixes for a wide range of vulnerabilities ranging from critical to low vulnerability levels

Google has again provided two security patch level strings to make it easier for OEMs to fix common vulnerabilities across the Android platform. Security patch level 2017-05-01 (partial) ensures that all vulnerabilities up to the 2017-05-01 date have been addressed, while security patch string 2016-05-05 (complete) indicates that all issues up to the 2017-05-05 date have been fixed. An overview of the particular vulnerabilities that have been patched has been detailed in the announcement post.

According to Google, the most severe of all patched vulnerabilities is one that could allow an attacker to remotely execute malicious code by using multiple mediums. Thankfully, Google has had no reports of active consumer exploitation or abuse of these newly reported issues. Source code patches for these issues will be released to the Android Open Source Project (AOSP) repository in the next 48 hours.

As usual, OTA updates will be rolled out to the Pixel devices and supported Nexus devices in the coming weeks. Meanwhile, the factory images and full OTAs are also available from the Android Developers site if you want to flash them manually.

Links for the factory images and full OTA's for Pixel and Nexus devices are given below for your convenience. We advise you to confirm that you are flashing the build intended for your device only.

Device (Codename)	Build Version	Factory Image	Full OTA Image
Pixel XL (marlin)	N2G47O	Link	Link
Pixel XL – Deutsche Telekom	N2G47T	Link	Link
Pixel XL – Verizon	NHG47L	Link	Link
Pixel (sailfish)	N2G47O	Link	Link
Pixel – Deutsche Telekom	N2G47T	Link	Link
Pixel – Verizon	N2G47L	Link	Link
Pixel C (ryu)	N2G47O	Link	Link
Nexus 6P (angler)	N2G47O	Link	Link
Nexus 5X (bullhead)	N2G47O	Link	Link
Nexus 6 (shamu)	N6F27C	Link	Link
Nexus Player (fugu)	N2G47R	Link	Link
Nexus 9 LTE (volantisg)	N4F27B	Link	Link
Nexus 9 WiFi (volantis)	N4F27B	Link	Link

Have you flashed the latest update? Let us know your experience with the new update in the comments below!

Source: Android Security Bulletin

from xda-developers http://ift.tt/2pQ5bYV
via IFTTT

Report: Huawei, Vivo and Oppo Show Impressive Growth During Q1 2017

Depending on where you live, you likely have differing opinions on the success of companies such as Huawei, Vivo and Oppo. Huawei has been able to garner some attention from the enthusiast crowd thanks to the company manufacturing the Nexus 6P. They also have their Honor sub-brand helping it get more attention in Europe and USA. Vivo and Oppo haven't done these things so some might look at them less favorably, although both continue to heavily invest in markets like India.

All three of these Chinese smartphone OEMs have been putting impressive growth lately. We just saw a report about how Huawei was able to take the #1 spot back from Oppo in China, and Vivo is also chipping in with some more competition. A new report from the IDC says these three smartphone OEMs combined were able to ship 15.5 million more smartphones. This brings their combined shipments for the first quarter of this year up to 77.9 million units.

When breaking this down individually, this growth is smaller, but it shows how much the Chinese smartphone market in general is growing. By comparison, Samsung was able to ship 79.2 million units during the same quarter, and Apple was able to ship 51.6 million units. We won't be seeing Vivo, Oppo and Huawei combine forces to take on bigger competition, but these numbers do show how much faster they're growing when compared to Samsung and Apple.

Samsung's market share for the quarter actually dropped by 1% while Apple's market share dropped by 0.5% during the same quarter. These three Chinese smartphone OEMs have been able to outpace market growth quarter after quarter for over a year. We are seeing these three companies releasing more premium and high-end smartphones these days. However, the IDC expects most of the growth from these companies to be from the low-end to mid-range market.

Source: The Investor

from xda-developers http://ift.tt/2poyLDf
via IFTTT

Skins Are Too Minimal. Cases Are Too Thick. CrashGuard from RhinoShield is Just Right.

Phone skins are great to add style to any phone, plus they're not expensive, but they provide minimal protection if you happen to drop your phone. On the other end of the spectrum are cases, which are generally more expensive but offer much more protection. Cases are bulky and they don't let the beauty of your phone show through because they often have to cover all four edges as well as the back of the phone.

That's where CrashGuard by RhinoShield comes in. CrashGuard is essentially a bumper case, which means that it does not cover the back of your phone but only the sides (thus giving your device a more "naked" feel), but because of how it's engineered, it provides more protection than most cases. CrashGuard is far superior to the bumpers of the past because it has been engineered to absorb impact. This is done by utilizing a proprietary polymer material that is far more shock-absorbent than plastic, and it also has a protective honeycomb structure within the bumper to disperse impact properly. In fact, within the honeycombs are compartments of pressurized air that act as airbags and deflect impact energy. If that sounds really elaborate, it is, and the net result is that you can drop your phone from a variety of heights (up to 11 feet) and if you have a CrashGuard bumper on the phone, you're going to have a completely unmarked phone. You've probably seen the insane drop test video. Here is a drop test video with the Galaxy S7 (RhinoShield tells us that they're working on their S8 drop test video and it's going to be epic):

"The bumper is super-lightweight, weighing at only 12 grams (less than half an ounce) yet it is still fully capable of providing at least the same level of impact protection as many leading brands or any other brick-like case product."

RhinoShield

Here's the CrashGuard for the Galaxy S8+…you hardly notice it's there, especially with this Midnight Black color.

The bumper has precision cuts that line up with the Galaxy S8+ ports perfectly.

Both the Galaxy S8 and Galaxy S8+ look really good with a CrashGuard installed.

The edge display is not compromised in any way.

"Our goal is to cover up as little of your device as possible while adding maximum protection. The bumper is only 2.5mm thick and yet it still offers extreme protection."

RhinoShield

Not only are CrashGuard bumpers durable, but they're lightweight (with most of their bumpers coming in under 14 grams). They're also pretty grippy thanks to the matte finish, and they come in a variety of colors. Another thing we really like about the CrashGuard line is the pricing: the Galaxy S8/S8+ bumper is priced at $24.99.

Order a CrashGuard for the Galaxy S8 Order a CrashGuard for the Galaxy S8 Plus

 

We thank RhinoShield for sponsoring this post. Our sponsors help us pay for the many costs associated with running XDA, including server costs, full time developers, news writers, and much more. While you might see sponsored content (which will always be labeled as such) alongside Portal content, the Portal team is in no way responsible for these posts. Sponsored content, advertising and XDA Depot are managed by a separate team entirely. XDA will never compromise its journalistic integrity by accepting money to write favorably about a company, or alter our opinions or views in any way. Our opinion cannot be bought.

from xda-developers http://ift.tt/2oP8lf3
via IFTTT