* Posts by ChrisCoderChap

7 publicly visible posts • joined 15 May 2020

This legit Android app turned into mic-snooping malware – and Google missed it

ChrisCoderChap

I recently bought a new Android 12 phone (with a real audio jack and SD card reader, hooray !) to act as a media player, coffee table browser and eventual replacement for when my trusty 6 year old phone finally dies, and spent a good hour or so removing permissions and disabling/uninstalling almost everything that came pre-installed.

I noticed a permission called something like 'Change system settings', which was enabled on numerous applications that I really didn't see had any reason to be doing anything of that nature. I disabled this everywhere of course, but noticed that if I disabled an application or removed other permissions before removing that one, when I re-opened the application info, the application was magically re-enabled with the default permissions. Disabling the change system settings permission first stopped it doing that.

This setting is a new one on me - my venerable old phone is incompatible with recent versions of Android so I guess it's from a more innocent phase of the permissions/sneaky workaround arms race.

My old phone is on the list of phones that can possibly run a favourable flavour of Linux given enough faffing about, a bluetooth keyboard and probably a magnifying glass to read the bash console, so I do have the option to adopt the new one as my main phone-for-now and re-image the old one, a project for when I'm a little less busy, but a nice thought.

Das reboot: That's the only thing to do when the screenshot, er, freezes

ChrisCoderChap

Re: NMNMN

There are deeper levels of devilry available along those lines, back in the mid-80's I was working for ICL, VME Comms department, we were implementing x.400 for VME on the shiny new 3900 mainframe using even shinier new DRS300 terminals.

Great little thin client/office setup, pretty cutting edge at the time, I imagine we were essentially beta-testing them. They were semi-dumb terminals running off a box per team which were mainly just used as terminal hosts to get at the mainframes (with.... tada!!! - multiple terminal sessions on one screen... up to 4 I think, amazing, more than one terminal per box, woohoo!), but we managed to get some games going.

One feature of the new DRS setup, apart from not looking like a robotic version of ET's head, was you could change the fonts, and even edit them. The traditional trick for newcomers to our team was to do the N/M physical key switch but with added vim, editing the N and M and n and m characters in the typeface to swap those too.

This meant when you pressed N (which was actually where the M key should be) it displayed N, when you pressed M it displayed M but under the covers of course they were swapped.

So your lovely S3 code would look perfect, but say BEGIN or THEN, would be interpreted as BEGIM and THEM, the compiler would barf out and you'd be told BEGIN and THEN weren't valid S3 - in those days printing out code was still a thing (god, dot matrix printers grinding away, there are some things one doesn't miss !), and there it'd give away the trick but unless you compared with the keyboard at the next desk it was pretty proof against discovery.

Easyjet hacked: 9 million people's data accessed plus 2,200 folks' credit card details grabbed

ChrisCoderChap

Re: @ChrisCoderChap -- OK, hands up ..

Cheers, here in Bali I'd kill for a proper beer which looked like that...

Now, if somebody can tell me how to persuade my code to get at the bloody Azure key vault when it's actually running on Azure that'd all be great, got my dev code using it fine but can't get the system test install to work, so it can't even open the database never mind process a transaction, it's one of those 'switch to branch, fight with it for half an hour, give up, do something less annoying for a while' problems !!

ChrisCoderChap

Re: OK, hands up ..

>Have you looked into Stripe?

We're using exactly them in fact, I say 'expensive' in comparison to not using them, I think their charges are perfectly reasonable.

They're also the mandatory default in a way, the 2 other 'big boy' card processors we contacted seemingly weren't interested enough in our tiddler of a company to reply to my initial 'send their support folk a few questions and see if they respond' pings. Stripe came back to me almost instantly.

The Stripe.net library is open source, I reported a bug in the new 36.12.1 recently (2 properties of a message type were marked internal rather than public by mistake), got a response in 10 minutes, they fixed it within half an hour and 36.12.2 was available in NuGet within the hour, I'd barely cloned the code and started working with a temporary fix before they'd released the fix-proper, now that's impressive !

ChrisCoderChap

Re: OK, hands up ..

Right now I'm coding the card-taking bit of a site I'm developing and no bloody way, my non-technical business partner wanted us to handle it all in-house to reduce transaction costs but I refused to. No way I'm being responsible for that sort of stuff.

We're using a proper/expensive card processing company, storing nothing card-related for one-off payments and only storing a token to re-identify customers for repeat subscription charges, and I'm being super-paranoid about that, Azure Key Vault for the db connection string and authentication key for the card processor, proofs against sql injection of course, custom obfuscation of the tokens and key itself (because why not), super-locked down privileges about which users can initiate financial stuff (not the ones used by interactive sessions for a start, not even admin users!) and I'm still looking around to see what else I can do.

The idea of leaking people's names and emails is scary enough, even for our small user-base, but card data; jeez, that's terrifying.

Mirror mirror on the wall, why will my mouse not work at all?

ChrisCoderChap

Re: Varieties of rodent

Just for ah, research purposes, you don't happen to have have any images of those 'nipple controllers' you mention do you ?

While the mice were all the same, back in the '90s I used to support a large office of admin staff processing complaints and refunds etc for a big credit card company. Close to 100 staff on a massive open plan floor with the French section here, German team there, Dutch round the corner etc. etc. - all with their own national keyboard layouts. Trying to sort out local issues, especially typing into the command prompt and the like to rejig lan connections and printers etc. was a bleedin' nightmare !!

The printer setup in particular was horrific, each team connected to different printers that had different languaged headed paper loaded, with different sub-flavours of headers in each tray depending on what level of customer the letter was for; gold card, platinum etc all had differently embossed paper.

Some folk handled customers in multiple languages, not just their native ones, each PC having a little set of paper badges at the top with the flags of the languages the staff member could be useful in, so they needed mapping to multiple sets of printers and have multiple keyboard setups in Windows, all configured manually on a machine by machine basis.

With a big staff turnover requiring a lot of reassigning of machines to new staff, general user tinkering, machine replacements etc - keeping that lot going even vaguely smoothly was akin to painting a suspension bridge with water-soluble paint - the social life was great though !

DBA locked in police-guarded COVID-19-quarantine hotel for the last week shares his story with The Register

ChrisCoderChap

Re: What a shit hole

He should at least be OK visa-wise for the time being, thankfully they're giving all foreigners that are still here free emergency visa extensions 'until further notice' without any need to apply or go to immigration etc. but obviously it's worth them checking the imigrasi web site/social media and/or keeping in touch with a visa agent for updates.

The lack of a major death count on Bali itself is most odd. As you say, Jakarta is bad for it though given the staggering population density and horrific conditions in many spots outside the shiny parts, it's amazing it's not a lot worse.

Bali population 680,000+ yet 'official' figures are 314 infections, 4 deaths (at least according to https://www.baliplus.com/2020/05/13/breaking-news-bali-hopes-to-be-the-1st-province-clear-of-covid-19-in-indonesia) but as mentioned above, my partner is a journo here and hasn't seen any evidence this is an understatement despite having recently been hired to discover otherwise by an Aussie rag.

I forgot to mention in my OP that there used to be dozens of direct flights a day from China to Bali, including from Wuhan itself, tens of thousands of Chinese holidaymakers are usually here year-round, Bali is a fave spot for Chinese tourists and there's a whole chunk of the island pretty much devoted to that sector of tourism (Nusa Dua in the vestigial-looking bit dangling off the bottom of Bali).

If you'd tried to design an environment specifically to be most vulnerable to this outbreak, you'd not have gone far wrong to create something that looks very much like Bali but we seem to be sidestepping the worst of it rather well, lord knows why, for sure it's not the social distancing and excellent general public health. Maybe my 'spiritually enthusiastic' long-term ex-pat guru-lady is right, this is the result of Ganesha holding Shiva at bay so we'd better keep doing the chanting and meditation and burn more incense.

The local economy on the other hand... will pretty much tank unless we get some kind of high season this summer, happily my income isn't directly related to folk arriving on aircraft but most locals and ex-pats I know are very much depending on it on one level or another. Many of my closest mates own or manage scuba dive outfits, restos, bars etc. and most are are just about hanging on to their employees for the moment can't do so for long with practically zero dollars coming in through the doors.

Lots of cars and scooters for sale on social media, restaurants selling the contents of their freezers etc. Now is typically a low-income time of year and people are stocked up with cash to some extent with last summer and Christmas not having been too bad (despite the quake the previous year, people really needed this summer to be a profitable one !) but it's not looking good, apart from good local supplies of rice, fish and a shitload of fruit, Bali essentially relies on tourism to stay afloat.