Hasta La Gadget!

When Apple addressed a congressional inquiry on privacy in July, the company claimed that it couldn’t actually track a particular iPhone in real time, as its transactions were anonymous and thoroughly randomized. Bucknell University network admin Eric Smith, however, theorizes that third-party application developers and advertisers may not have the same qualms, and could be linking your device to your name (and even your location) whenever they transmit data. Smith, a two-time DefCon wardriving champ, studied 57 top applications in the iTunes App Store to see what they sent out, and discovered that some fired off the iPhone’s UDID and personal details in plaintext (where they can ostensibly be intercepted), including those for Amazon, Chase Bank, Target and Sam’s Club, though a few were secured with SSL. Though UDIDs are routinely used by apps to store personal data and combat piracy, what Smith fears is that a database could be set up linking these UDIDs to GPS coordinates or GeoIP, giving nefarious individuals or organizations knowledge of where you are.

It’s a scary idea, but before you direct hate Apple’s way, it’s important to note that Cupertino’s not necessarily the one to blame. iOS is arguably the best at requiring users to opt-in to apps that perform GPS tracking; transmitting the UDID and account information together publicly is strictly against the rules; and we’d like to think that if users provide their personal information to an application developer in the first place, they’d understand what they’re doing. Of course, not all users monitor those things closely, and plaintext transmission of personal details is obviously a big no-no.

Smith’s piece opens and closes on the idea that Apple’s UDID is like the unique identifier of Intel’s Pentium III processor, which generated privacy concerns around the turn of the century, and we wonder if ths story might play out the same way — following government inquiries, Intel offered a software utility that let individuals manually disable their chip’s unique ID, and removed it from future CPUs.

Hacker claims third-party iPhone apps can freely transmit UDID, pose serious threat to privacy originally appeared on Engadget on Sun, 03 Oct 2010 19:51:00 EDT. Please see our terms for use of feeds.

Permalink   |  PSKL  | Email this | Comments

Something as simple as changing your Android phone’s wallpaper or downloading a ringtone could transmit personal data about you, including your location, without your knowledge.

Sound farfetched? It’s not: About 15 of 30 randomly selected, popular, free Android apps sent sent users’ private information to remote advertising servers and two-thirds of the apps handled data in ambiguous ways, say researchers.

The researchers at Duke, Intel Labs and Penn State University, created a tool called TaintDroid that identifies apps transmitting private data to distant locations. TaintDroid monitors how applications access and use your location, microphone, camera, phone numbers in your contact list. The tool also provides feedback once an app is newly installed, letting you know if the app is transmitting data.

“This automatic feedback gives users greater insight into what their mobile applications are doing and could help users decide whether they should consider uninstalling an app,” says Peter Gilbert, a graduate student in computer science at Duke University who’s working on the project. The TaintDroid program isn’t publicly available yet.

The latest data supports a study published in June by mobile security company SMobile Systems that found 20 percent of the then-available 48,000 third-party applications for the Android operating system provided sensitive or private information to outside sources.

Data collection practices in apps are increasingly becoming a major privacy issue for consumers. In July, a mobile security firm called Lookout identified a free wallpaper Android app, Jackeey, that allegedly gathered data about its users, including their phone numbers, carrier subscriber identifiers and phone number of their voicemail accounts. The app then sent the information to a website based in China. The Jackeey app is estimated to have anywhere from 1 to 4 million downloads.

Read more…

Dell Streak and Accessories, from Dell.com

The Dell Streak was always an odd fit for the consumer market — smaller than other tablets, bigger than other smartphones. But Dell sees a bright future for it in enterprise in general, and medicine in particular.

Dell’s Jamie Coffin and Scott Jenkins recently mapped their healthcare strategy for ZDNet. Because Dell healthcare services already provides IT infrastructure for over 350 hospitals, they can integrate their portable devices and software with the systems already in place — an advantage Apple, Samsung, and other tablet makers can’t match.

Devices that store and handle medical information have to fulfill a very strict set of requirements. Besides hooking into a hospital or healthcare network’s systems, there’s HIPAA, or the Health Insurance Portability & Accountability Act, a 1996 law that protects patient privacy.

There are also security nightmares whenever a device storing confidential information is lost or networked communications are transferred without encryption or or other security protections. Finally, medical devices have to be rugged, germ-resistant, and capable of working in disaster scenarios without ready access to electricity or a data network. This is one significant reason why hospitals’ information systems frequently seem so low-tech; it’s not recalcitrance, but redundancy by design.

For these reasons, medical devices are usually provided by specialized providers who can meet these requirements. They’re typically expensive, with patents or scarcity preventing competition, and UI is (ahem) not particularly a priority. Consumer devices, on the other hand, can beat specialized devices on price and usability. Dell thinks that they can leverage their consumer and enterprise positions to offer the best of both worlds.

Also, it really is just the right size for a lab coat pocket.

Dell Healthcare and Life Sciences [Dell]
Dell’s enterprise Streak plan: Target verticals like healthcare [ZDNet]
Dell Streak may soon be streaking into lab coat pockets [TeleRead]

See Also:

• Hands On: Dell 'Streak' Tablet Feels Like Supersized Phone …
• Dell Streak Priced at $300 For AT&T
• Dell's Streak Tablet Is Priced Like a Phone
• Dell 'Streak' Tablet U.S. Debut in July for $500
• Dell Streak Tablet Official, Crippled by Android 1.6
• Teardown Shows That Resilient Dell Streak Is Easy to Repair …
• Dell Streak
• Obama's Computerized Hospital Vision May Have Blind Spot
• E-Health Gaffe Exposes Hospital

Though a now-infamous Pennsylvania school district admitted to taking thousands of pictures of schoolchildren without their consent, federal investigators have decided not to pursue criminal charges. That doesn’t halt a class-action complaint against the district (which charges invasion of privacy and wiretapping) but a US attorney told reporters that FBI and police investigators hadn’t found proof beyond a reasonable doubt that school employees had criminal intent to spy on students using their school-issued laptops.

On a related note, students returning to Lower Merion for a new school year can set their minds at ease, as the school board just approved a new set of laptop regulations that (among other things) ban remote monitoring of microphones and webcams. Feel free to pick through for technical loopholes at our more coverage link, and let’s hope this little LMSD soap opera is finally at an end.

Lower Merion, PA school district cleared of Federal spying charges, approves new privacy policies originally appeared on Engadget on Tue, 17 Aug 2010 16:30:00 EDT. Please see our terms for use of feeds.

Permalink   |  Associated Press, Philadelphia Inquirer  | Email this | Comments

The forty-eight hour deadline came and went, but Saudi Arabia didn’t pull the plug — citing a “positive development” in RIM’s efforts to appease Saudi regulators, the country has allowed BlackBerry messaging services to continue for the time being. Saudi Arabia’s Communications and Information Technology Commission (CITC) didn’t specify what the aforementioned “development” was, but thanks to well-placed anonymous sources we can hazard a guess: “CITC will now be able to monitor communications via messaging services,” one Saudi telecom official told the Wall Street Journal, and Reuters reports that RIM will hand over BlackBerry decryption codes to the country. That’s all for now, but expect this issue to bubble back to the surface again in the United Arab Emirates come October.

Saudi Arabia pleased by RIM’s concession, says BlackBerry messaging can stay for now originally appeared on Engadget on Tue, 10 Aug 2010 15:33:00 EDT. Please see our terms for use of feeds.

Permalink   |  Wall Street Journal, Reuters  | Email this | Comments