Did you manually install Pokémon Go? Re-enable this important Android security setting

We don’t recommend installing APKs from outside the Play Store — but if you do, it’s worth unchecking ‘unknown sources’ afterwards.

Maybe you wanted to play Pokémon Go in a country where it’s not officially available yet. Maybe you installed an APK from somewhere that’s not the Google Play Store to do that. We’re not gonna judge you.

In order to install your illicit Pokémon APK, you’ll have had to enable the “Unknown sources” toggle under Security settings. That’s the switch which is disabled by default on all Android phones and prevents apps from being installed from places other than the Google Play Store.

Some Samsung phones will automatically toggle the “Unknown sources” back off once you’ve installed an APK from elsewhere. But most other Android phones don’t, and it’s a good idea to keep this setting switched off in case a rogue website or message pushes you towards a dodgy APK.

It’s worth noting that toggling this switch won’t do anything to apps you might’ve already installed from outside the Play Store, including Pokémon Go. So if you have downloaded a version infected with malware, the setting won’t help you out — it’ll just block future app installs from outside the Play Store.

To check “Unknown sources” is off, go to Settings > Security (or Settings > Lock screen & security on Samsung phones) and scroll down to find the option.

Now you can get back to scooping up Pokémon and capturing gyms.

Pokémon Go

• Requirements to play Pokémon Go
• The Ultimate Pokémon Go Game Guide!
• How to play without killing your battery
• Be careful where you download from
• Join our Pokémon Go forums!

What is Pokemon Go and why is everyone talking about it?

Pokémon Go fever is sweeping the world, turning people into phone-gazing zombies as they bimble about the place hunting for little cartoon characters with silly names.

So what exactly is going on? Should you join in the fun? Should you be concerned?

Here’s everything you need to know about Pokémon Go.

What is Pokémon Go?

Pokémon Go is a new mobile game from the Pokémon universe for Android and iOS. It is based around Pokémon fundamentals of finding, catching, evolving, training and battling Pokémon. 

In the case of Pokémon Go, this happens on your smartphone and in the real world around you, so you need to go out, search and find Pokémon in real places, rather than just in a game world. 

Why is everyone talking about Pokémon Go?

Pokémon has always been a huge franchise, in gaming, merchandising and on TV, thanks to the cutesy characters like Pikachu. The new game launched in some countries on 6 July, so it’s new and exciting for Pokémon fans.

But it’s not just the fans. The novelty of the game sees it as a breakthrough, mapping the real world and using augmented reality to take the game into a new dimension through mobile devices and making you get out into the real world.

It is highly addictive, it’s fun and it’s just turned into the biggest craze, taking over social media and just about every other conversation.

What’s that about augmented reality?

Augmented reality (AR) is when what you see in the real world is changed by technology. In this case, it uses the camera on the rear of your smartphone and places the characters from the game for you to see on your display, blending the real world and the game world.

That means that the Pokémon appear in real places, rather than a made-up world. This is one of the reasons it’s so exciting, because AR brings the game to life and you’ll find Pokémon down your street, at your local park and so on.

• Pokémon Go: Best, worst and craziest places people have found Pokémon

Does Pokémon Go involve exercise?

Yes it does. Pokémon Go is a game that encourages, nay, demands that you get off your sofa and explore, because that’s the only way you’ll find the Pokémon. 

You can’t move around just by using your thumbs, you have to actually walk to real places on the map, outside, and see what you can find. There are Pokémon to capture, game objects to collect from Poké Stops and Pokémon Gyms to train or battle in, and all these things are in the real world.

So Pokémon Go rewards you for being active?

Yes it does. One of the ways it does this is by letting you find eggs, which you place into an incubator and they only hatch once you’ve walked a certain distance – that might be 2km, it might be 5km. 

You will also get awards for walking distances. Cover 10km in the game and you’ll get an award for that, as well, of course, finding more places with Poké Stops, Gyms and Pokémon to catch. 

Where can I find Poké Stops and Pokémon Gyms?

They’re all over the place, but typically you’ll find a Poké Stop in a place of cultural significance. That might be a statue, historical building, local pub, or some other feature of local importance. You don’t have to go into places, unless they cover a lot of land. Often if you’re close, that’s good enough. 

That means that empty places might have very few Poké Stops, like remote country areas, and some are densely populated with Poké treats, like city centres.

Pokémon Gyms are even bigger locations, like a transport hub, bridge or other significant location. For some good examples, see what we found when exploring the Pokémon Go map around London

• London through the eyes of Pokémon Go

Is Pokémon Go safe?

As safe as the real world can be. The distraction of watching your phone means you’re a risk of walking into things like roads, or worse, driving into things if you’re playing when you’re supposed to be driving your car. We’ve seen a Gym on the other side of a railway and there’s the temptation to stand too close to the tracks, just to access that Gym.

As for encouraging people to explore places they don’t normally go, that could be good and bad. Yes, you find things you might not normally notice in your local town, but at the same time, the pursuit of Pokémon could easily lead you on and on to places you really shouldn’t be.

You can also drop lures and this is one of the contentious issue. These are in-game elements to attract Pokémon to a particular (real) position and other gamers can benefit, by walking into the same (real) place. That’s fun in a park during a day, less fun down a dark alley at night.

The message about the real world remains the same: use your head and if you have kids, make sure you know what they’re doing.

Is the Pokémon Go app secure?

There have been concerns raised about privacy in Pokémon Go in the early days. 

Firstly, with lots of people trying to get access to the game before it’s officially available, there’s plenty of opportunity for fake versions of the app to appear containing malware – especially on Android where installing apps is very easy. If in doubt, don’t do it and wait.

Secondly there have been questions raised over the access that the Pokémon Go asks when you sign in with a Google account – and this affects both iOS and Android users. Some have reported that it’s listed as having granted itself full access to your Google account, which is normally reserved for top-level Google apps. 

We’re sure this latter point will be addressed and clarified, but again, if you’ve any doubt about what’s happening to your data, then just say no and wait until you’re sure.

How much does Pokémon Go cost?

Pokémon Go works on a freemium model. That means the game itself is free, but there are in-app purchases available.

The way this works is offering you a store where you can buy things using coins. These coins can be bought in the app using real money. 

For example: you can buy 200 Poké Balls for 800 coins. You can buy 1,200 coins for £7.99 – that’s real money. Or you can visit lots of Poké Stops and collect Poké Balls for free. If you’re rich and impatient then the world is your oyster.

The longer-term question is whether game progress is hampered by not spending real money. At that point you either have to decide the fun is worth the price, or accept that you’ve reached the limit of playing without paying. This is how freemium games work and one to watch, especially if you have kids using your phone and they are able to make in-app purchases.

What impact does Pokémon Go have on battery life?

Massive. As the game wants the phone to be awake when you are walking around, it’s using the display, data to sync with the game services and the GPS, as well as tracking motion. As it’s a benefit to walk around with your phone awake, as that’s how you find things, it’s all that screen-on time that kills the battery. 

What can you do about battery drain? You can stop playing, or carry an external battery pack.

How can I get Pokémon Go?

Pokémon Go is available as an app to download for Android and iOS. It’s available now in the relative app stores, but the availability is limited.

• Click here to download Pokémon Go for iOS
• Click here to download Pokémon Go for Android

Because of a phased global roll-out, only some territories have official access to the game – like Australia, Japan, New Zealand and USA.

However, eager fans have figured out other ways to get hold of the game and start playing before its official arrival in their countries.

If Pokémon Go is not yet available to you, follow these instructions to get started, but bear in mind that with a game this popular there may be fake versions loaded with malware, so you do so at your own risk. If you’re unsure, you might want to just wait until it’s officially launched. 

When will Pokémon Go launch in the UK?

That’s a good question. At the moment a launch date hasn’t been confirmed, other than to say it will be “soon”, but rumours are already suggesting that Pokémon Go might launch on 14 July in the UK.

Alex Gibney on Stuxnet and why we need to talk about cyberwar

It’s been six years since we’ve discovered Stuxnet, the worm that infected Windows PCs worldwide, and was eventually traced to the US and Israel as a way to attack Iran’s nuclear program. It was the first time a cyberweapon was used to attack a physical location (it disabled uranium enriching centrifuges by causing them to spin out of control), and it sparked a series of cyberattacks from governments all over the world. Alex Gibney, the acclaimed documentarian behind films like Taxi to the Dark Side, Enron: The Smartest Guys in the Room, and the recent Steve Jobs: The Man in the Machine, decided to dive into Stuxnet’s legacy with his latest film, Zero Days. I sat down to chat with him about the film, together with Symantec researchers Eric Chien and Liam O’Murchu.

Why make a film about Stuxnet now?

Alex Gibney: I have a habit, I guess, of going in after big stories and trying to find out a little bit more about them; doing a deeper dive. Sometimes, in the kind of of relentless 24-hour news cycle, a simple and easy narrative develops and then you just move on without understanding the broader implications. It seemed to me this story had legs.

What were you hoping to add to the conversation?

Gibney: To really take stock of this idea that it was a crossing of the Rubicon, as [former director of the NSA and CIA] Michael Hayden said. It’s a kind of a moment that changed everything, that launched us into a new era. That’s what I was trying to get at.

Eric and Liam, what convinced you cybersecurity researchers to participate in this film?

Liam O’Murchu: I like the fact that Stuxnet ties into a bigger picture. At the time when we analyzed it, it was a unique beast and we didn’t see too many other [cyber] threats that were driven by governments. Where as now we’re tracking over 100 operations run by governments and we see them all the time. So although Stuxnet is a standalone piece, it’s a beacon of how things have changed and how progressing towards cyber war actually fits into a much bigger threat landscape.

Alex, you’ve covered traditional warfare in your previous films, how is covering cyberwarfare different?

Gibney: There’s an interesting aspect to it, in the sense that some parts of it are very different. This idea that you’re using spyware, and out of that spyware comes the ability to manipulate the physical environment. Once you get to the physical environment, then things are similar. That’s like sabotage. And also, these kinds of attacks are also surrounded by human intelligence. So it’s really interesting because it’s creating damage in the physical world, but it’s a weapon system really coming out of the intelligence world, both in terms of signal and human intelligence.

A technician at the Uranium Conversion Facility in Tehran, Iran.

You’ve related the rise of cyberwarfare in the film to the the rise of nuclear weapons. How is it different?

Gibney: That can be overdrawn. When you drop an atomic weapon on a city, we know from Hiroshima and Nagasaki what’s going to result. And it’s horrific. I think in many ways cyberweapons are not that brutal at all. Nevertheless, once you start talking about messing with critical infrastructure, which can be things like changing controls in a high speed train or poisoning a water filtration system, you have the potential for consequences that are vast even though they don’t have that visceral destructive, explosive capability that atomic weapons do.

Eric and Liam, do we have a decent understanding of cyber weapons at this point?

Eric Chien: The capability will likely grow. Even when we look at Stuxnet, when we began researching it in 2010 we found traces going back to 2006. So already, then, we were potentially four years behind what the known capabilities are. There are likely things out there that haven’t been discovered, that are more advanced.

I think the unfortunate thing, to be frank, is that to cause an impact — to cause potential destruction to critical infrastructure — it doesn’t require any more capabilities than what we have today. The Ukrainian power grid went out in December, and the attack was believed to be from Russia. This is already possible today.

Gibney: I think that one of the surprises for us [was] we started this as a story about Stuxnet. We didn’t know that along the way we would discover Nitro Zeus, which is a much more potent attack which involves basically shutting down a country. As someone says in the film, the cyberwar science fiction scenario is here.

Stuxnet was a massive weapon that we kind of had to let go, we couldn’t exactly control how it acted once it was in the wild. Is that something we have to think about in terms of cyberwarfare, constructing something that hopefully does what you tell it?

Chien: I would hope now that we’ve had Stuxnet that people would make good conscious choices. Stuxnet was a case where someone made a choice and decided we’re going to make this autonomous, more aggressive, and we are willing to have collateral damage. Stuxnet could infect any Windows machine, anywhere in the world that was connected to the internet. That’s a lot of collateral damage to go after a single target.

It’s been six years since you began researching Stuxnet, Eric and Liam. What have we seen since?

O’Murchu: We’re seeing a lot more in that threat landscape of just general government malware infecting all sorts of systems. We see a lot of espionage. actually. We see a lot of particular categories of companies being targeted, like chemical companies, defense contractors, aerospace. We also see preparation, some threats where countries are getting into crucial networks like those control systems and leaving backdoors behind, so that in some point in the future they can come and use that.

Chien: When you come from zero, everything we see now is new. We continue to see things that, to be frank, astound us. You might remember the Swiss bank attacks, where one billion dollars was being attempted to transfer. That’s been traced back to be connected to the Sony wiping attacks, which the US government tied to North Korea. Now you potentially have North Korea potentially transferring one billion dollars to themselves, which would be the first time a nation state just tried to steal money via a cyber attack.

Stuxnet is kind of an open secret: everyone knows who the players were. But the US government hasn’t admitted to it, and hasn’t talked about it. Why do you think that is?

Gibney: The obvious reason is that it was designed originally as a covert operation. It was a CIA and Mossad operation. That’s something I didn’t fully appreciated when I started this story. So by nature it’s covert. But the frustrating part is because of this momentum of over-classification, once the operation was blown it’s the refusal to talk about that that seems so appalling. Because you can’t begin to start talking about the capabilities of these weapons, and what we’re going to do about them in the future.

Even more disquieting than the refusal to talk about Stuxnet, because nations play these games all the time, well if we say we were responsible officially, then the Iranians can hold us to account officially for attacking their critical infrastructure. If we never say it, just like the Israelis have never admitted they have nuclear capabilities, we all know that they do, but at some point it becomes ridiculous, like the Emperor’s New Clothes.

It’s particularly problematic though when you can’t even talk about cyberwar or weapons. So you can’t look on the budget of the American government and see how much we’re spending on cyberweapons, it’s secret. What kind of cyberweapons do we have? It’s secret.

That’s the part that’s disquieting, because you don’t know what kind of risk we’re putting others under, and you assume that other nations have these nations and they’re training them on us, so we don’t know what risk we’re under.

If everything the government does is secret, how is there going to be any accountability?

Alex Gibney

Can you talk further about the need to speak openly about cyberweapons? What do you think we have to gain by opening up the conversation?

Gibney: Rules of the road. Like I said, when we started the Stuxnet story, it was a technical story about a gadget, or a kind of malware. What can it do? But the larger questions that usually remain unanswered are the legal and moral questions. A good analogy can be drones. We can agree that weaponized drones are far more accurate than the bombers we used in the Vietnam war, or even the bombers we have today. But under what conditions are they used? What kind of people are they taking out? Our “signature strikes” are the kind of thing where you see a group of young men together and assume they’re bad guys, so you kill them.

What’s the legal rationale for that, and what’s the blowback? Do other people feel they now have the right to do the same thing we’re doing? So it’s those issues surrounding cyberweapons that haven’t even really begun to be examined, and that’s why you have rules of the road. Seems like [now], well you have a war so, just do whatever damage you can do. But there are rules of war. There are laws of war. They’re there for a reason, to constrain and limit the damage from this kind of thing and prevent, you know, chaos.

Knowing everything you know now about Stuxnet, do you think it was a good idea?

Gibney: Knowing what we know now, no, I don’t think it was a good idea. Having said that, it was a brilliant weapon as it was conceived, in terms of having a limited impact. But so often with these weapons, the immediate fix is what people focus on. That’s the challenge. How do you keep Israel from bombing Iran? Well, how about Stuxnet. How do you keep Iran from developing a bomb? Well, Stuxnet, good idea: It’ll delay them.

But look at what happened afterwards, nobody thinks about the unintended consequences. So the Iranians ratcheted up their nuclear capability. They ratcheted up their cyber capability, and now we have a kind of weapon and a use. That is to say, it was used outside the laws of war, so that now we have chaos.

Do you think the US government has learned anything from this fiasco? That is, partnering with someone to build and use a tool, and it ends up blowing up in their face.

Gibney: It’s hard to know what they’ve learned, because so much is secret. We did have [NSA director] Michael Rogers recently admitting to the use of cyberweapons against ISIS. I find it interesting he admitted it against ISIS, because ISIS is sort of the international pariah, you can do anything to ISIS. But we’re not really admitted the fact we’re putting implants all over the world, or those countries are putting implants here. Those are the kinds of discussions we’re still not having, even as I understand it, with our elected representatives who are supposed to be more in the know.

The Obama administration has talked a lot about transparency, but meanwhile it pushed forward on secrecy and making Stuxnet even worse.

Gibney: The Obama administration on secrecy has just been appalling, absolutely appalling, both in terms of the number of secrets they keep and the punishments being meted out for people who leak. It’s an odd thing. You’d think, if you’re the Obama administration you’d say this stuff is supposed to be secret and we’ll prosecute people. But for a long time there was an intentional balance between secrets and leaks, because that’s part of the democratic process. Because ultimately, if everything the government does is secret, how is there going to be any accountability?

You were able to get fascinating people to talk about Stuxnet, you even got [former NSA/CIA director] Michael Hayden. Was it difficult to convince them to participate?

Gibney: Michael Hayden is becoming increasingly expert at talking about just about anything, but he had some insights that I never expected. Particularly regarding the Bush administration, of which he was very much a part. I found it interesting from the US perspective, he implies, that Stuxnet was developed not to stop Iran from getting the bomb, but to stop Israel from bombing Iran, which inevitably would have embroiled us in a third war in the Middle East.

Despite the Stuxnet blowup, it does seem like a better outcome than Israel trying to attack Iran.

Gibney: Yes, so from that technical standpoint Stuxnet, you could argue was a good idea. It’s just the implications of launching that kind of weapon without thinking about the ramifications down the road, and what kind of precedent it set.

We’re seeing surveillance normalized in society, it almost seems like cyberwarfare is getting there too. Is there a danger in that?

Eric: I think the real danger is that people are mostly unaware. I’m not sure we’re in a position right now where everyone is well aware of it, the impact and are okay with it. I think we’re at a stage well before that, where people simply aren’t aware and aren’t aware what are the possible long term consequences.

Photo credits: Iranian nuclear facility/AP Photo/Vahid Salemi

MIT anonymity network promises to be more secure than Tor

As crucial as Tor’s anonymity network can be for keeping your online activity private, it’s not flawless — a motivated hacker can compromise legions of users, whether they’re crooks or privacy-minded innocents. Researchers from MIT and EPFL might have a better way. They’ve developed an anonymity network, Riffle, that promises to maintain privacy so long as at least one server is safe.

The secret is the use of a mixnet, where servers switch the order of messages as they’re received, but without using relatively inefficient public keys. Instead, Riffle relies on a verifiable shuffle (where you shake up a message’s encryption but can verify the changes) across all servers for the initial connection, and authentication encryption (where you prove the validity of the encrypted message itself) for the rest. In essence, even compromised servers can’t mess things up — they have to shuffle messages correctly for the good servers to accept the incoming data.

And importantly, the technique is extremely efficient, to the point where transferring takes a tenth of the time that it would on a conventional anonymity network. That’s particularly important when the nodes on these networks are frequently users’ computers. You’d rather not bog down your computer while it checks other users’ traffic, after all. Riffle is a long way from becoming practical, but its mix of tougher security and minimal overhead could make it a communication method of choice for anyone worried that they might be watched.

Source: MIT News