submitted by /u/sheshbabu
[link] [comments]
from programming https://ift.tt/2VTuurS
Thursday, April 30, 2020
Wednesday, April 29, 2020
Meet EventBot, a new Android malware that steals banking passwords and two-factor codes
Security researchers are sounding the alarm over a newly discovered Android malware that targets banking apps and cryptocurrency wallets.
The malware, which researchers at security firm Cybereason recently discovered and called EventBot, masquerades as a legitimate Android app — like Adobe Flash or Microsoft Word for Android — which abuses Android’s in-built accessibility features to obtain deep access to the device’s operating system.
Once installed — either by an unsuspecting user or by a malicious person with access to a victim’s phone — the EventBot-infected fake app quietly siphons off passwords for more than 200 banking and cryptocurrency apps — including PayPal, Coinbase, CapitalOne and HSBC — and intercepts and two-factor authentication text message codes.
With a victim’s password and two-factor code, the hackers can break into bank accounts, apps and wallets, and steal a victim’s funds.
“The developer behind Eventbot has invested a lot of time and resources into creating the code, and the level of sophistication and capabilities is really high,” Assaf Dahan, head of threat research at Cybereason, told TechCrunch.
The malware quietly records every tap and key press, and can read notifications from other installed apps, giving the hackers a window into what’s happening on a victim’s device.
Over time, the malware siphons off banking and cryptocurrency app passwords back to the hackers’ server.
The researchers said that EventBot remains a work in progress. Over a period of several weeks since its discovery in March, the researchers saw the malware iteratively update every few days to include new malicious features. At one point the malware’s creators improved the encryption scheme it uses to communicate with the hackers’ server, and included a new feature that can grab a user’s device lock code, likely to allow the malware to grant itself higher privileges to the victim’s device like payments and system settings.
But while the researchers are stumped as to who is behind the campaign, their research suggests the malware is brand new.
“Thus far, we haven’t observed clear cases of copy-paste or code reuse from other malware and it seems to have been written from scratch,” said Dahan.
Android malware is not new, but it’s on the rise. Hackers and malware operators have increasingly targeted mobile users because many device owners have their banking apps, social media, and other sensitive services on their device. Google has improved Android security in recent years by screening apps in its app store and proactively blocking third-party apps to cut down on malware — with mixed results. Many malicious apps have evaded Google’s detection.
Cybereason said it has not yet seen EventBot on Android’s app store or in active use in malware campaigns, limiting the exposure to potential victims — for now.
But the researchers said users should avoid untrusted apps from third-party sites and stores, many of which don’t screen their apps for malware.
from TechCrunch https://ift.tt/3aOYaKP
Tuesday, April 28, 2020
Samsung expects COVID-19 to hurt smartphone and TV sales, but increase demand for memory
In its first-quarter earnings report today, Samsung said it expects the COVID-19 pandemic to continue impacting its business for the rest of the year, cutting into sales for smartphones and TVs, but increasing demand for PCs, servers and memory chips as people continue to work or study from home.
Samsung’s results for the first-quarter of 2020 was in line with the guidance it released earlier this month. Operating profit was 6.45 trillion Korean won (about $5.3 billion). Revenue fell about 7.6% from the previous quarter to 55.33 trillion won, due to a seasonal drop in demand for displays and consumer electronics, and the impact of the pandemic.
The COVID-19 pandemic has caused more than 3 million confirmed cases around the world and more than 217,000 deaths, and resulted in shelter-in-place orders in countries around the world and a global recession.
Samsung said that because the pandemic’s impact through the second half of 2020 remains uncertain, it plans to make flexible investments and adjust its product mix to adapt. Because it expects competition among manufacturers to increase as they try to recover from a weak first half, Samsung said it will continue to launch premium products like a new foldable and Note devices, and expand 5G to more mass-market smartphones.
Samsung’s display panel business saw a decline in earnings during the first quarter due to weak seasonality and lower sales in China during COVID-19 shutdowns, and it expects demand to continue being impacted by the pandemic and postponement of major sporting events like the Summer Olympics.
On the other hand, Samsung expects to see solid performance in its memory business as remote work, online education, online shopping and streaming entertainment services continue putting more demands on cloud providers and data centers. As a result, Samsung will speed up its transition to 1Z-nm DRAM and 6th-generation V-NAND flash memory.
Samsung also said it plans to offset store and plant closures around the world through flexible supply networks, improving its online sales capabilities, and tailoring promotions and logistics for different market.
from TechCrunch https://ift.tt/2xmLJIA
Can API vendors solve healthcare’s data woes?
A functioning healthcare system depends on caregivers having the right data at the right time to make the right decision about what course of treatment a patient needs.
In the aftermath of the COVID-19 epidemic and the acceleration of the consumer adoption of telemedicine, along with the fragmentation of care to a number of different low-cost providers, access to a patient’s medical records to get an accurate picture of their health becomes even more important.
Opening access to developers also could unlock new, integrated services that could give consumers a better window into their own health and consumer product companies opportunities to develop new tools to improve health.
While hospitals, urgent care facilities and health systems have stored patient records electronically for years thanks to laws passed under the Clinton administration, those records were difficult for patients themselves to access. The way the system has been historically structured has made it nearly impossible for an individual to access their entire medical history.
It’s a huge impediment to ensuring that patients receive the best care they possibly can, and until now it’s been a boulder that companies have long tried to roll uphill, only to have it roll over them.
Now, new regulations are requiring that the developers of electronic health records can’t obstruct interoperability and access by applications. Those new rules may unlock a wave of new digital services.
At least that’s what companies like the New York-based startup Particle Health are hoping to see. The startup was founded by a former emergency medical technician and consultant, Troy Bannister, and longtime software engineer for companies like Palantir and Google, Dan Horbatt.
Particle Health is stepping into the breach with an API-based solution that borrows heavily from the work that Plaid and Stripe have done in the world of financial services. It’s a gambit that’s receiving support from investors including Menlo Ventures, Startup Health, Collaborative Fund, Story Ventures and Company Ventures, as well as angel investors from the leadership of Flatiron Health, Clover Health, Plaid, Petal and Hometeam.
Image via Getty Images / OstapenkoOlena
“My first reaction when I met Troy, and he was describing what they’re doing, was that it couldn’t be done,” said Greg Yap, a partner with Menlo Ventures, who leads the firm’s life sciences investments. “We’ve understood how much of a challenge and how much of a tax the lack of easy portability of data puts on the healthcare system, but the problem has always felt like there are so many obstacles that it is too difficult to solve.”
What convinced Yap’s firm, Menlo Ventures, and the company’s other backers, was an ability to provide both data portability and privacy in a way that put patients’ choice at the center of how data is used and accessed, the investor said.
“[A service] has to be portable for it to be useful, but it has to be private for it to be well-used,” says Yap.
The company isn’t the first business to raise money for a data integration service. Last year, Redox, a Madison, Wis.-based developer of API services for hospitals, raised $33 million in a later-stage round of funding. Meanwhile, Innovaccer, another API developer, has raised more than $100 million from investors for its own take.
Each of these companies is solving a different problem that the information silos in the medical industry presents, according to Patterson. “Their integrations are focused one-to-one on hospitals,” he said. Application developers can use Redox’s services to gain access to medical records from a particular hospital network, he explained. Whereas using Particle Health’s technology, developers can get access to an entire network.
“They get contracts and agreements with the hospitals. We go up the food chain and get contracts with the [electronic medical records],” said Patterson.
One of the things that’s given Particle Health a greater degree of freedom to acquire and integrate with existing healthcare systems is the passage of the 21st Century Cures Act in 2016. That law required that the providers of electronic medical records like Cerner and EPIC had to remove any roadblocks that would keep patient data siloed. Another is the Trusted Exchange Framework and Common Agreement, which was just enacted in the past month.
“We don’t like betting on companies that require a change in law to become successful,” said Yap of the circumstances surrounding Particle’s ability to leapfrog well-funded competitors. But the opportunity to finance a company that could solve a core problem in digital healthcare was too compelling.
“What we’re really saying is that consumers should have access to their medical records,” he said.
Isometric Healthcare and technology concept banner. Medical exams and online consultation concept. Medicine. Vector illustration
This access can make consumer wearables more useful by potentially linking them — and the health data they collect — with clinical data used by physicians to actually make care and treatment decisions. Most devices today are not clinically recognized and don’t have any real integration into the healthcare system. Access to better data could change that on both sides.
“Digital health application might be far more effective if it can take into context information in the medical record today,” said Yap. “That’s one example where the patient will get much greater impact from the digital health applications if the digital health applications can access all of the information that the medical system collected.”
With the investment, which values Particle Health at roughly $48 million, Bannister and his team are looking to move aggressively into more areas of digital healthcare services.
“Right now, we’re focusing on telemedicine,” said Bannister. “We’re moving into the payer space… As it stands today we’re really servicing the third parties that need the records. Our core belief is that patients want control of their data but they don’t want the stewardship.”
The company’s reach is impressive. Bannister estimates that Particle Health can hit somewhere between 250 and 300 million of the patient records that have been generated in the U.S. “We have more or less solved the fragmentation problem. We have one API that can pull information from almost everywhere.”
So far, Particle Health has eight live contracts with telemedicine and virtual health companies using its API, which have pulled 1.4 million patient records to date.
“The way it works right now, when you give them permission to access your data it’s for a very specific purpose of use… they can only use it for that one thing. Let’s say you were using a telemedicine service. I allow this doctor to view my records for the purpose of treatment only. After that we have built a way for you to revoke access after the point,” Bannister said.
Particle Health’s peers in the world of API development also see the power in better, more open access to data. “A lot of money has been spent and a lot of blood and sweat went into putting [electronic medical records] out there,” said Innovaccer chief digital officer Mike Sutten.
The former chief technology officer of Kaiser Permanente, Sutten knows healthcare technology. “The next decade is about ‘let’s take advantage of all of this data.’ Let’s give back to physicians and give them access to all that data and think about the consumers and the patients,” Sutten said.
Innovaccer is angling to provide its own tools to centralize data for physicians and consumers. “The less friction there is in getting that data extracted, the more benefit we can provide to consumers and clinicians,” said Sutten.
Already, Particle Health is thinking about ways its API can help application developers create tools to help with the management of COVID-19 populations and potentially finding ways to ease the current lockdowns in place due to the disease’s outbreak.
“If you’ve had an antibody test or PCR test in the past… we should have access to that data and we should be able to provide that data at scale,” said Bannister.
“There’s probably other risk-indicating factors that could at least help triage or clear groups as well… has this person been quarantined has this person been to the hospital in the past month or two… things like that can help bridge the gap,” between the definitive solution of universal testing and the lack of testing capacity to make that a reality, he said.
“We’re definitely working on these public health initiatives,” Bannister said. Soon, the company’s technology — and other services like it — could be working behind the scenes in private healthcare initiatives from some of the nation’s biggest companies as software finally begins to take bigger bites out of the consumer health industry.
from TechCrunch https://ift.tt/2W5i8eU
Thuan Pham, who fled Vietnam as a child and became Uber’s CTO in 2013, is leaving the company
Thuan Pham, hired as Uber’s chief technology officer by former CEO Travis Kalanick back in 2013, is leaving the company in three weeks, the ride-share giant revealed today in an SEC filing that came out as a piece today in The Information reported that massive layoffs at Uber are being proposed to preserve some of the company’s precious capital.
The outlet suggests the discussed cuts could impact upwards of 20 percent of Uber’s 27,000 employees, roughly 800 of whom could theoretically come from Pham’s engineering team, which currently comprises 3,800 people.
Said an Uber spokesman to The Information’s Amir Efrati: “As you would expect, the company is looking at every possible scenario to ensure we get to the other side of this crisis in a stronger position than ever.”
Uber has been hard hit as much of the country and world remains at home, awaiting a vaccine for — or at least more testing around — COVID-19. Last Thursday, Uber said it expects an impairment charge of up to $2.2 billion in the first quarter due to the outbreak and for revenue to nosedive by $17 million to $22 million in the quarter. (The company will report its first quarter results next Thursday.)
Pham has meanwhile become the longest-serving top executive at Uber, outlasting not just Kalanick, who was forced to resign as CEO back in 2018, but also the members of Kalanick’s so-called “A team” of trusted advisors, including Ryan Graves, who was one of Uber’s first employees a board member of the company until last May; Uber’s former head of product, Daniel Graf; Eric Alexander, who was Uber’s president of business in Asia and was fired in 2017 over his handling of a rape investigation in India; and Emil Michael, Uber’s controversial former SVP of business who left the company in 2017, though it remains unknown if he resigned or was fired.
Pham — who was recruited by Kalanick from VMWare, where he’d spent the previous eight years — stood to make more than $200 million from Uber’s IPO last year, according to Business Insider. At the time, he owned 5.4 million shares.
It’s a true American success story. At age 12, Pham escaped Vietnam with his mother and brother in a fishing boat that was reportedly carrying dozens of other refugees. After first spending 10 months at camp in Indonesia that he has described as having no sanitation and offering only a carp over their heads, his family later arrived in Maryland and Pham, an excellent student, wound up studying at MIT.
Pham would go on to nab a master’s degree in electrical engineering before being drawn to job in Silicon Valley, where his first job was at Hewlett Packard. He said after three years, he “got bored” and joined Silicon Graphics, whose cofounder, Jim Clark, would later cofound Netscape with a young Marc Andreessen.
Pham spoke at a startup event early last month, before the Bay Area instituted its shelter-in-place rules. You can check out the talk below.
from TechCrunch https://ift.tt/35c1izg
Monday, April 27, 2020
Spring Boot JMSTemplate With Embedded ActiveMQ
In the video below, we take a closer look at Spring Boot JMSTemplate with Embedded ActiveMQ. Let's get started!
from DZone.com Feed https://ift.tt/3eX55Vz
Secure Mule API by Auth0 (External Identity Provider)
JWT-Based API Authentication Using Auth0 and Mulesoft
Web API security is concerned with the transfer of data through APIs that are connected to the internet. Auth0 is an external identity provider that enables systems to give access to REST API resources (exposes via MuleSoft) without having to share passwords.
What Is an Identity Provider?
It is a service that creates and maintains identity information and then provides authentication services to your applications. Identity Providers can significantly reduce sign-in and registration friction, which allows your users to easily access applications without needing to create new passwords or remember usernames
from DZone.com Feed https://ift.tt/3eWjdOS
What Is CIDR (Classless Inter-Domain Routing) in MuleSoft VPC
Introduction
CIDR stands for Classless Inter-Domain Routing and it way of allocating IP address or host in more efficient manner. It replaces the old way of allocating IP address on based of class system. This method allocate the IP Addresses or host in more efficient way and avoid waste of IP Addresses.
- Class A, 16 million host identifiers or IP Addresses.
- Class B, 65,535 host identifiers or IP Addresses.
- Class C, 254 host identifiers or IP Addresses.
Let's consider the Organization requiring around 500 IP Addresses or Host. In such cases, organizations have to go with a Class B IP distribution system where almost more than 60,000 IP addresses are wasted.
from DZone.com Feed https://ift.tt/3brPOK1
Introduction to Couchbase for MongoDB Developers and Experts
Six thousand years ago, the Sumerians invented writing for transaction processing - Gray & Reuter
By any measure, MongoDB is a popular document-oriented JSON database. In the last dozen years, it has grown from its humble beginnings of a single lock per database to a modern multi-document transaction with snapshot isolation. MongoDB University has trained a large number of developers to develop on the MongoDB database.
There are many JSON databases now. While it's easy to start with MongoDB to learn NoSQL and flexible JSON schema, many customers choose Couchbase for performance, scale, and SQL. As you progress in your database evaluation and evolution, you should learn about other JSON databases. We're working on an online training course for MongoDB experts to learn Couchase easily. Until we publish that, you'll have to read this article. :)
from DZone.com Feed https://ift.tt/2SbpKLC
DJI’s mini Mavic Air gets an upgrade with improved camera and battery life
DJI had to kibosh its usual big unveil this time out, for obvious reasons, but the company won’t let a little thing like a global pandemic get in the way of an announcement. A little over two years after unveiling its lightweight Mavic Air, the drone giant is announcing the sequel.
When I reviewed the original shortly after the announcement, most of my complaints centered around the product’s usefulness. True, it was an impressive bit of engineering, but that only gets you so far. This time out, DJI looks to have addressed at least some of those issues. Among them, improved battery capacity.
The original’s 21 minutes of life was among my key frustrations with the product. The company says the drone should be able to get up to 34 minutes on a charge. We’re taking a system for a spin and will keep you updated on how that translates into real life.
I found a handful of usability errors the first time out, as well. There are, thankfully, some upgrades on the software front, including, most notable, a new version of ActiveTrack. The feature is said to have improved subject tracking on board, including the ability to relocate an something temporarily obscured by an object, like a tree. The Point of Interest and Spotlight features have gotten upgrades, as well.
Imaging is, once again, the thing here. As such, the biggest updates are on the picture and video front. The new Air is able to shoot 4K video at 60 frames a second. Stills can be shot at up to 49 megapixels, while the three-axis gimbal should help alleviate some of the drone’s shaking. The system can also do 8x slow motion and shoot photos and video in HDR. There are new low-light settings and scene recognition features, as well.
Other on board improvements include improved wireless transmission and upgraded obstacle avoidance. The latter is particularly useful for novice fliers, but is a welcome addition for any level.
The Mavic Air 2 is available today in China. Worldwide shipping (including the U.S.) has been significantly complicated by the COVID-19 crisis. Pre-orders are open today and it’s “expected” to ship in mid-May. DJI understandably doesn’t seem especially certain at this point. The system starts at $799. There’s also a $988 version that includes a charging hub, three batteries and a carrying case.
[gallery ids="1979864,1979865,1979866,1979867,1979868,1979869,1979870,1979871,1979872,1979873,1979874,1979875,1979876,1979877,1979878"]
from TechCrunch https://ift.tt/35bnzwZ
Qoala raises $13.5M to grow its insurance platform in Indonesia
Online lending firms might be beginning to feel the heat of the coronavirus pandemic in Southeast Asia, but investors’ faith in digital insurance startups remains unflinching in the region.
Jakarta-based Qoala has raised $13.5 million in its Series A financing round, the one-year-old startup said Tuesday. Centauri Fund, a joint venture between funds from South Korea’s Kookmin Bank and Telkom Indonesia, led the round.
Sequoia India, Flourish Ventures, Kookmin Bank Investments, Mirae Asset Venture Investment, Mirae Asset Sekuritas and existing investors MassMutual Ventures Southeast Asia, MDI Ventures, SeedPlus and Bank Central Asia’s Central Capital Ventura participated in the round, which pushes the startup’s to-date raise to $15 million.
Qoala works with leading insurers including AXA Mandiri, Tokio Marine, Great Eastern to offer customers cover against phone display damage, e-commerce logistics and hotel-quality checks. The startup says it offers personalized products to customers and eases the burden while making claims by allowing them to upload pictures.
The startup maintains partnership with several e-commerce firms including Grabkios, JD.ID, Shopee and Tokopedia and hotel and travel booking firms PegiPegi and RedBus.
It uses machine learning to detect fraud claims. It’s a win-win scenario for customers, who can make claims easily and have more affordable and sachet insurance products to buy, and for insurers, who can reach more customers.
Qoala processes more than 2 million policies each month, up from 7,000 in March last year. The startup said it is working on insurance products to cover health and peer-to-peer categories. The startup, which employs about 150 people currently, plans to double its headcount in a year.
“As a relatively new entrant in the space we are delighted to partner with leading global investors whose tremendous thought leadership as well as operational experience will allow us to maintain our innovative edge. This truly demonstrates the ecosystem’s belief in what Qoala is trying to achieve — humanizing insurance and making it accessible and affordable to all,” said Harshet Lunani, founder and chief executive of Qoala, in a statement.
Kenneth Li, managing partner at Centauri Fund, said Qoala’s multi-channel approach has the potential to unlock Indonesia’s untapped insurance industry.
“Our thesis identified that Indonesia has a considerably low gross written premium (GWP) to GDP ratio in comparison to other emerging countries, coupled with the large growing middle class in need of more security in their financial planning which allows immense potential for the insurance sector to take off in Indonesia through innovative propositions,” he added.
According to one estimate (PDF), Southeast Asia’s digital insurance market is currently valued at $2 billion and is expected to grow to $8 billion by 2025. Last week, Singapore-based Igloo extended its Series A financing round to add $8.2 million to it.
from TechCrunch https://ift.tt/3aMYDwR
NY attorney general calls out Amazon’s ‘inadequate’ COVID-19 measures and ‘chilling’ labor policies
The New York attorney general’s office reportedly sent a sternly-worded letter to Amazon telling the company that the measures it has taken regarding the COVID-19 pandemic “are so inadequate that they may violate several provisions of the Occupational Safety and Health Act,” and firing outspoken workers sends “a threatening message to other employees.”
The letter, not yet published but obtained by NPR (I’ve asked the NY AG for confirmation of the contents), is only informational and does not amount to legal action. But the wording is strong enough to suggest that legal action may be the next step.
While we continue to investigate, the information so far available to us raises concerns that Amazon’s health and safety measures taken in response to the COVID-19 pandemic are so inadequate that they may violate several provisions of the Occupational Safety and Health Act.
These are precisely the concerns brought up by many warehouse workers over the last two months, including Chris Smalls, who was fired in March after protesting the conditions at the facility where he worked.
Amazon says Smalls was not fired for riling up the workers. Yet reportedly at a meeting attended by Jeff Bezos, the company’s General Counsel suggested making him “the face of the entire union/organizing movement” before following with “our usual talking points about worker safety.”
(Amazon would not confirm or deny those comments took place when TechCrunch asked about them at the time, but did provide a quoted apology by the person who may or may not have said them.)
Two more outspoken employees were fired two weeks later for “repeatedly violating internal policies.” Naturally the usual talking points followed.
The NY AG’s letter said the office is looking into “cases of potential illegal retaliation,” and addresses this pattern as follows:
This Office has learned that many workers are fearful about speaking out about their concerns following the termination of Mr. Smalls’ employment. This is a particularly dangerous message to send during a pandemic, when chilling worker speech about health and safety practices could literally be a matter of life and death.
Amazon routinely protests that it is a paragon when it comes to labor, but is just as routinely contradicted by workers, like Smalls, who have experienced the reality of working at its warehouses.
Amazon issued its “usual talking points” to NPR as a response to the story, saying: “We encourage anyone to compare the health and safety measures Amazon has taken, and the speed of their implementation, during this crisis with other retailers.” The attorney general seems prepared to take the company up on that invitation.
from TechCrunch https://ift.tt/2KBDjQs
Subscribe to:
Posts (Atom)