International Journalists GMail Account Hacked in China, China Against Human Right !

The independent Chinese magazine Caixin has said that unidentified hackers broke into the private Gmail account of one of its investigative reporters following the publication of articles that accused local government officials of taking part in child-trafficking.

The Foreign Correspondents' Club of China sent an e-mail Monday to its members warning that reporters in at least two news bureaus in Beijing said their Gmail accounts had been broken into, with their e-mails surreptitiously forwarded to unfamiliar accounts.

The Caixin reporter, Zhao Hejuan, recently contributed to a series of investigative reports on child-trafficking, and the apparent complicity of officials in Hunan Province’s Longhui County. Last week, she began to suspect that someone was accessing her e-mail.

As the magazine explained in a statement on Friday:

Zhao learned of the attacks July 21 after receiving a Gmail security alert. Caixin’s I.T. department later uncovered evidence that the hacks into Zhao’s account went as far back as July 19. Based on Gmail’s I.P. history, the hackers had logged on to Zhao’s Gmail account every day since July 19. Zhao and Caixin’s legal affairs consultant reported the incident to district police in Beijing on July 22.

The news comes just one week after Google said it had been targeted by recent cyberattacks aimed at accessing the Gmail accounts of Chinese human rights activists. The U.S. search giant cited the attacks as one reason it has decided to stop censoring its Chinese search engine and may ultimately close its China offices, a threat China has dismissed.

Google spokesperson Kay Oberbeck said :

“These highly sophisticated attacks and the surveillance they have uncovered — as well as attempts over the past year to limit free speech on the web even further - have led us to conclude that we are no longer comfortable censoring results in China and that we must take a new approach in China,”

Google Also Said that:

 "hackers were only able to view account information and subject headers of emails, and that only two email accounts were compromised, the company has nevertheless increased security for all Gmail users."  

However, A final report on the investigation has yet to be released, and the magazine appears to be standing by its reporting, although it has not published any reply to Mr. Zeng’s statement.

The first reported incident of e-mail hacking against Caixin occurred several days after Mr. Zeng’s comments.

Switch from outdated email to GMail: Email Intervention !!

Google started a new marketing campaign to promote its Gmail services, with a tag line "Save your friends from outdated email". In this matter, the search company has created a new web site calling it as "Email Intervention," and that makes it easier than ever to help your friends and family make the switch.





Staging an intervention is simple:

1.Visit emailintervention.com

2.Sign in and automatically identify who from your contacts has yet to make the switch, or just enter a friend’s email address manually

3.Choose from one of three intervention message templates (“straightforward”, “concerned” or “ embarrassed”), and add your own intervention video if you’d like

4.Send a customized email and follow up as needed

Watch the video below:

Source
Google BLog

Stop Using Paypal : Anonymous and LulzSec says, Ebay Stock Price Drops !

Anonymous and LulzSec have declared war on eBay’s PayPal with a boycott of the payment service and the fallout could have some real financial implications.

Anonymous, together with LulzSec, issued a press release  urging PayPal users to close their accounts immediately and consider an alternative. They pointed to PayPal's willingness to "fold to legislation" as proof that it doesn't deserve its customers and the business they give to the payments providers.

Not surprisingly, Anonymous and LulzSec are urging a legal boycott of PayPal. The groups said:

In recent weeks, we’ve found ourselves outraged at the FBI’s willingness to arrest and threaten those who are involved in ethical, modern cyber operations. Law enforcement continues to push its ridiculous rules upon us - Anonymous “suspects” may face a fine of up to 500,000 USD with the addition of 15 years’ jail time, all for taking part in a historical activist movement. Many of the already-apprehended Anons are being charged with taking part in DDoS attacks against corrupt and greedy organizations, such as PayPal.

According to a Tuesday report by U.S.-based alternative news site, The Raw Story, 20-year-old University of Nevada journalism student Mercedes Haefer faces a jail term of up to 15 years and $500,000 in fines if convicted of hacking charges.

Cnet Reports,Shortly after the new post hit the Web today, Anonymous claimed through its Twitter account that PayPal had lost more than 9,000 accounts in just a couple of hours. The group also claimed that PayPal had taken down its Web page where people can cancel their accounts, though the site seemed to be up and running normally.

ZDNet reports, the Federal Bureau of Investigation (FBI) arrested her last week for allegedly participating in distributed denial-of-service (DDoS) attacks against PayPal last year as part of the "Operation Payback" campaign.

Operation Payback was an organized launch of DDoS attacks against entertainment websites like the Recording Industry Association of America and Motion Picture Association of America. The attack was sparked by members of the image board website 4chan.

Wikileaks is showing support by tweeting: "We support the work of #Anonymous in drawing attention to the economic blockade of #Wikileaks by corrupt financial institutions. #OpPayPal"

EBAY STOCK PRICE DROP!!

EBay's share price dropped over 2.5 percent at the beginning of Nasdaq trading on Wednesday.

WikiLeaks was quick to crow drop of price on Ebay's stock. Anonymous' campaign dealt a "$933M stock crash" this morning for PayPal parent eBay. Shares in eBay did drop over 2.5 percent at the market open, but have since recovered somewhat.

Evercore financial analyst Ken Sena told ZDNet UK  that the Anonymous action was unlikely to have had much of an effect on investors. Sena instead attributed the fall to strong results posted by Amazon on Tuesday.

"eBay shares are suffering from Amazon posting really strong results," said Sena. "I don't see this [Anonymous action] as a big driver."

Already, people are responding to Anonymous' call. One user, Pantha85, tweeted:
"Account Closed. Mmake you bleed from the only place you care.. your wallet. thanks @YourAnonNews #oppaypal #anonymous".

Another follower, Pacific_Justice, pointed out: 


"Next reason to join #OpPaypal and cancel your account: they created an illegal financial blockade of #WikiLeaks - a publishing organization".

There is no information on how long the boycott would last, although a tweet at 3.32 p.m. on Wednesday revealed an estimated "few hundred" PayPal accounts have been closed so far.

This is not the first time hacking groups like Anonymous have targeted financial institutions. Visa and MasterCard were also attacked for their role in blocking donations to Wikileaks.

Scotland Yard: LulzSec spokesman arrested

(AP)  

Scotland Yard says officers from its specialist cybercrime unit have arrested the suspected spokesman of the Lulz Security hacking group.

Metropolitan Police Central eCrime Unit (PCeU) statement said that:

"The man arrested is believed to be linked to an ongoing international investigation in to the criminal activity of the so-called 'hacktivist' groups Anonymous and LulzSec, and uses the online nickname 'Topiary',"

In a statement Wednesday the police force says that the 19-year-old was arrested at an address in Scotland's Shetland Islands on Wednesday. They say he is the name behind the hacker known as "Topiary," who has given several interviews in recent weeks.

LulzSec, an offshoot of the amorphous hacking collective known as Anonymous, has claimed responsibility for a series of hacking attacks on both sides of the Atlantic.

More details soon ...

As per  Report By CBS news

Googel plus have Official Apps for iPhone [Download Link Available]

Today Google Plus have launched Official Apps for iPhone users. The App is Compatible with iPhone 3, iPhone 3Gs and iPhone 4 and Required iOS 3.1or later

The App is 5.8 mb in size and can be Download via

Google Plus for iOS Download Link

iPhone screenshot

Facebook iPad App Leaked

A Canadian engineering student Marvin Bernal found the code for the tablet app hidden inside the iPhone app and noted it on Twitter.

In his Tweet he said
“If you change the UIDeviceFamily to 2 for iPhone on the Facebook app you get an iPad version!”

The Facebook iPad app has been a long-awaited feature, since many mobile Apple users have complained about the look and functionality of the iPhone version of the app. Many users have said that the layout in general causes difficulty in app navigation.

Techcrunch posted a gallery of screen captures that shows the app to be elegant, and with an interesting left-side navigation bar that looks to be a big improvement over the sometimes clunky process of getting around on the iPhone app. Numerous icons are also found along the top of the app to guide users.

The Facebook iPad app, which was written with HTML5, has an excellent navigation system. It uses a left-side menu that can be accessed by simply touching a button on the screen, displaying most Facebook options in one instance. It also has a great-looking photo-viewer, and makes better use of overlay menus than the iPhone version. When the iPad is turned horizontally, the user's list of online friends appears, allowing them to chat while navigating other parts of Facebook. In addition, Facebook Places allows the user to view a larger map that shows all friends situated around you. In other words, the iPad version looks and navigates much better than the iPhone version.

SCREEN SHOT

According to mashable.com Author

Update: It looks like Facebook has blocked access to the app at this time. Still, you can check out our screenshots to see how the app looks.

Image Source : mashable

Google Provides Solution :Android Phones Store mail Passwords In Plain Texts! :

A Android user complain that , All passwords are stored in plain text on Disk via a message on discussion board of Android.

Android phones store passwords for email and some other services in plain text which as you can expect is a nightmare for many users.

“The password for email accounts is stored into the SQLite DB which in turn stores it on the phone’s file system in plain text. Encrypting or at least transforming the password would be desirable.”


For those people who think think again as if you ever lose your Android phone someone can easily root it and pull the data off it. This is a big security nightmare for many users. this security risk is only for rooted phones well

Android Support "Andy Stadler" Reply that :

Thanks for the information and the feedback on this concern.


First, I would like to reiterate the notes made by a couple of you, which is to remind users that if you are concerned about this issue, *please* simply click the star. Every time you respond "please fix" or "should be fixed!" it sends email to over 200 people.


Second, please know that we take information security very seriously, and this is baked into the Android platform at multiple levels.


A Android user complain that , All passwords are stored in plain text on Disk via a message on discussion board of Android.


A Android user complain that , All passwords are stored in plain text on Disk via a message on discussion board of Android.


Now, with respect to this particular concern. The first thing to clarify is that the Email app supports four protocols - POP3, IMAP, SMTP, and Exchange ActiveSync - and with very few, very limited exceptions, all of these are older protocols which require that the client present the password to the server on every connection. These protocols require us to retain the password for as long as you wish to use the account on the device. Newer protocols don't do this - this is why some of the articles have been contrasting with Gmail, for example. Newer protocols allow the client to use the password one time to generate a token, save the token, and discard the password.


I urge you to review the article linked to in comment #38, which is well-written and quite informative. It provides some very good background on the difference between "obscuring" passwords, and making them truly "secure". Simply obscuring your password (e.g. base64) or encrypting it with a key stored elsewhere will *not* make your password or your data more secure. An attacker will still be able to retrieve it.




(In particular, some claims have been made about some of the other email clients not storing the password in cleartext. Even where this is true, it does not indicate that the password is more secure. A simple test: if you can boot up the device and it will begin receiving email on your configured accounts, then the passwords are not truly secure. They are either obfuscated, or encrypted with another key stored somewhere else.)


To the author of comment #44: If you can obtain *any* data from files in /data/data/* on a non-rooted device, this is a security problem in the device, not a bug in the Email program. I urge you to contact our security team and provide more information (details here: http://developer.android.com/guide/appendix/faq/security.html)


Having said all this - rest assured, I am not closing this bug. We recognize that this is causing concern for some users, and we're going to look at identifying steps that can make your data more secure.




Andy Stadler
stadler@android.com


Google Solution Have been found

If you want to enable encryption on your device based on Android 3.0 aka HoneycombFor first release, we only support encrypt in place, which requires the framework to be shutdown, /data unmounted, and then every sector of the device encrypted, after which the device reboots to go through the process described above. Here are the details:

1.From the UI, the user selects to encrypt the device. The UI ensures that there is a full charge on the battery, and the AC adapter is plugged in. It does this to make sure there is enough power to finish the encryption process, because if the device runs out of power and shuts down before it has finished encrypting, file data is left in a partially encrypted state, and the device must be factory reset (and all data lost).
Once the user presses the final button to encrypt the device, the UI calls vold with the command "cryptfs enablecrypto inplace " where passwd is the user's lock screen password.

2.vold does some error checking, and returns -1 if it can't encrypt, and prints a reason in the log. If it thinks it can, it sets the property vold.decrypt to "trigger_shutdown_framework". This causes init.rc to stop services in the classes late_start and main. vold then unmounts /mnt/sdcard and then /data.

3.If doing an inplace encryption, vold then mounts a tmpfs /data (using the tmpfs options from ro.crypto.tmpfs_options) and sets the property vold.encrypt_progress to "0". It then preps the tmpfs /data filesystem as mentioned in step 3 for booting an encrypted system, and then sets the property vold.decrypt to "trigger_restart_min_framework". This causes init.rc to start the main class of services. When the framework sees that vold.encrypt_progress is set to "0", it will bring up the progress bar UI, which queries that property every 5 seconds and updates a progress bar.

4.vold then sets up the crypto mapping, which creates a virtual crypto block device that maps onto the real block device, but encrypts each sector as it is written, and decrypts each sector as it is read. vold then creates and writes out the crypto footer.

The crypto footer contains details on the type of encryption, and an encrypted copy of the master key to decrypt the filesystem. The master key is a 128 bit number created by reading from /dev/urandom. It is encrypted with a hash of the user password created with the PBKDF2 function from the SSL library. The footer also contains a random salt (also read from /dev/urandom) used to add entropy to the hash from PBKDF2, and prevent rainbow table attacks on the password. Also, the flag CRYPT_ENCRYPTION_IN_PROGRESS is set in the crypto footer to detect failure to complete the encryption process. See the file cryptfs.h for details on the crypto footer layout. The crypto footer is kept in the last 16 Kbytes of the partition, and the /data filesystem cannot extend into that part of the partition.

5.If told was to enable encryption with wipe, vold invokes the command "make_ext4fs" on the crypto block device, taking care to not include the last 16 Kbytes of the partition in the filesystem.

If the command was to enable inplace, vold starts a loop to read each sector of the real block device, and then write it to the crypto block device. This takes about an hour on a 30 Gbyte partition on the Motorola Xoom. This will vary on other hardware. The loop updates the property vold.encrypt_progress every time it encrypts another 1 percent of the partition. The UI checks this property every 5 seconds and updates the progress bar when it changes.

6.When either encryption method has finished successfully, vold clears the flag ENCRYPTION_IN_PROGRESS in the footer, and reboots the system. If the reboot fails for some reason, vold sets the property vold.encrypt_progress to "error_reboot_failed" and the UI should display a message asking the user to press a button to reboot. This is not expected to ever occur.

7.If vold detects an error during the encryption process, and if no data has been destroyed yet and the framework is up, vold sets the property vold.encrypt_progress to "error_not_encrypted" and the UI should give the user the option to reboot, telling them that the encryption process never started. If the error occurs after the framework has been torn down, but before the progress bar UI is up, vold will just reboot the system. If the reboot fails, it sets vold.encrypt_progress to "error_shutting_down" and returns -1, but there will not be anyone to catch the error. This is not expected to happen.

If vold detects an error during the encryption process, it sets vold.encrypt_progress to "error_partially_encrypted" and returns -1. The UI should then display a message saying the encryption failed, and provide a button for the user to factory reset the device.


Full Details on

Android Developers