How Google’s ‘Project Zero’ task force races hackers to snuff out bugs

Programmers test for bugs before their code enters the wild, but the errors that slip through can become

dangerous ‘zero-day’ exploits for hackers.

(in)Secure is a weekly column that dives into the rapidly escalating topic of cybersecurity.

In 2016, Yahoo confirmed it was the victim of a massive cyberattack that put the personal information of 500 million email users at risk. It was one of the biggest thefts of online personal information in the history of the internet. Yet the hack didn’t happen in 2016 — it happened in 2014.

Many of the largest, most sophisticated cyberattacks utilize zero-day exploits.

Upon further investigation, U.S. Senator Mark Warner insisted Yahoo executives knew about the problem before the company was sold to Verizon. History repeated itself with the monumental Equifax breach, where executives sold two million dollars in stock just days after learning of the hack. The question of who knew what — and when they knew it — is of the utmost importance.

Project Zero was created by Google for situations just like this. It’s a cybersecurity task force that acts behind the scenes with the stated goal to “significantly reduce the number of people harmed by attacks.” They don’t do interviews or comment on their work. Instead, the group keeps a low profile. Its findings and impact on the industry, however, are anything but quiet.

The search for zero-day bugs

The beginnings of the group can be traced back to 2014, when the circle of cybersecurity professionals was officially formed inside the halls of Google. According to the group’s manifesto post, the task force was first put together to secure its own products.

But in light of internet-wide security concerns like Heartbleed, and Edward Snowden’s government surveillance revelations, Google set a new target on zero-day vulnerabilities across the entire industry.

You may not have heard of a “zero-day” vulnerability, but the consequences of them make headlines. It’s a term used in the computer security industry about a bug or vulnerability that’s unknown to the maker of the software. Many of the largest cyberattacks fall into this category of zero-day exploits, often leaving companies, and those who use their products, blind-sided.

When a company finds a vulnerability that moment is known as “day zero” – and for the next 90 days, it’s a ticking time bomb.

This was Intel in July of 2017, when it was alerted of 20-year old bugs in x86 and ARM-based hardware that impact nearly every CPU in circulation. As told by Wired, it was first discovered by Project Zero’s 22-year old hacker, Jann Horn, while diving deep into Intel’s own documentation on its processors. The flaw wasn’t introduced in the company’s latest hardware. It’d been around for years, but no one had noticed – or, at least, no one willing to disclose the flaw publicly instead of using it to their advantage.

Google’s crack team of hackers aren’t the only ones on the hunt for zero-day vulnerabilities. An entire market is built around discovering them, including bug bounty programs implemented by large corporations — and the black-market buying and selling of zero-day vulnerabilities. Even the NSA has been criticized for participating in purchasing zero-day vulnerabilities and stockpiling them for the development of cyberweapons. That’s why Project Zero’s approach to ethics is as important as its ability to spot bugs.

The day-zero countdown clock

Project Zero follows “responsible disclosure,” which has become an industry standard for keeping the public safe from zero-day bugs. After all, releasing vulnerabilities to the public would only help cybercriminals exploit them. Project Zero’s way of side-stepping this is to report the vulnerabilities to manufacturers privately, giving them 90 days to address the bug before it’s made public. The day a company finds out about a vulnerability is known as “day zero” – and for the next 90 days, it’s a ticking time bomb.

The countdown-clock nature of responsible disclosure pushes companies to quickly and effectively deal with the problem before things go public. It’s the reason Intel is being questioned for the way it reacted to the Spectre and Meltdown discoveries. The company never released information to its industry partners or federal government, making its public disclosure in January that much more painful. What if Intel wasn’t on the clock? When would it disclose the problem? Would it ever? We’ll never know for sure, but the company’s delay wasn’t a good look.

Your browser does not support the video tag.

Meltdown and Spectre exploit critical vulnerabilities in modern processors. Programs can utilize the exploit to

retrieve valuable sensitive data being processed by the computer. The above gif shows an example of Meltdown stealing data via memory dump.

When the timeline expires, Project Zero publishes the vulnerability as promised, even if it’s not fixed. The task force has found multiple, hackable problems within the Edge web browser, and Microsoft has been slow to act. Thanks to Project Zero’s approach to responsible disclosure, we know about those vulnerabilities now. Microsoft’s security flaws are out in public, for everyone to see – and those read about it may choose to avoid Edge. That kind of public pressure encourages companies to make cybersecurity, and the privacy of its users, a priority.

Project Zero can’t solve malware on its own, of course. This is only Google’s way of “getting the ball rolling” and “doing their part.” There will always be more vulnerabilities, as well as institutions and criminals looking to exploit them for their own agenda. Still, it’s nice to know that as this issue becomes more public, someone is out there hunting for bugs with our security in mind.

Editors’ Recommendations

• New ‘Prime’ Meltdown, Spectre exploits outlined by Nvidia, Princeton University
• Intel’s 9th-generation ‘Ice Lake’ CPUs will have fixes for Meltdown, Spectre
• Microsoft’s latest Windows 10 patch will address Spectre Variant 2 CPU flaw
• Nvidia’s latest software update helps protect your system from ‘Spectre’
• Did I do that? Intel is going to make a killing fixing its own Meltdown

Netgear’s Arlo smart cameras now support Google Assistant

Available for the Arlo Pro 2, Go, Baby, and more.

Nest and Ring may be the top names in the smart security camera space, but that doesn’t mean they’re the only ones out there. Netgear’s Arlo line of cameras are fairly popular, too, and now they’re getting even better with full Google Assistant integration.

With this update, you’ll be able to see live video feeds of your cameras by either talking or typing to the Assistant. You can tell your Google Home to “show the Backyard on the Living Room TV” if you have an NVIDIA Shield TV or Chromecast-enabled television, and if you’re out and about, you can ask the Google Assistant to show you any of your camera fees right on your phone.

To get all of this working, simply open the Google Assistant on your phone, go to Settings, Home control, and then search for “Arlo.”

Most all Arlo cameras support Google Assistant controls, including:

• Arlo Pro 2
• Arlo Pro
• Arlo Go
• Arlo Q
• Arlo Q Plus
• Arlo Baby

Now that Arlo’s jumped on board the Assistant train, are you more inclined to get one over its many competitors?

How to set up and customize Google Assistant

How to make your phone look like a Galaxy S9

Say what you will about Samsung’s TouchWiz software — and I can say plenty — it’s a very distinctive look.

The Samsung Galaxy S9 is here, and with it comes another update of Samsung’s software UI. This year is more of a polishing than last year’s overhaul, with the S9’s home screen sporting an array of geometric wallpapers, wireframe icons, and distinctive widgets. Even if you pre-ordered a Galaxy S9, it’s not showing up for a few weeks. While you’re waiting, why not get some of that modern sleekness on your current phone with our very own Samsung-inspired theme?

Wallpapers

I’m opposed to stock wallpapers on principle, but the wallpapers packaged with the Samsung Galaxy S9 are really enticing. They’re somewhat diverse; some feature geometric patterns in various colors, but there’s also a dandelion one, a few styles featuring the “9” branding, and some simple ones with faded color streaks. We’ve extracted all of the pre-installed wallpapers for the S9 and S9+, and there are 19 in total for you to choose from.

Download all the Samsung Galaxy S9 wallpapers

Launcher magic

Now, we can’t get the Samsung launcher on non-Samsung phones the way that we can get the BlackBerry Launcher or the ZenUI Launcher from ASUS, but that doesn’t mean we can’t get what we desire from other, more customization-friendly launchers. There are a few things we’re looking for here:

• Folders: This is one of the few areas where third-party launchers can outdo TouchWiz itself! At least, Action Launcher can. Action Launcher has a wide, wide array of folder shortcut styles available, and two of those styles are TouchWiz and TouchWiz (outline). You can choose either of these options in **Action Settings > Folders & Shutters > Style to achieve squircle folders to match our squircle icons.
• Swipe for app drawer: Samsung lets you open the app drawer in TouchWiz by swiping up or down anywhere on the home screen itself, much like the Google Pixel 2. For Nova Launcher, you can turn this on in Nova Settings > App & widget drawers > Swipe to open. For Action Launcher, you can turn this on in Action Settings > Shortcuts > Swipe up.
• App labels: Samsung keeps apps labeled on both the home screen and dock. To turn that on in Nova Launcher, you’ll turn on home screen labels under Nova Settings > Desktop > Icon layout > Label. You can turn on dock labels under Nova Settings > Dock > Icon layout > Label. In Action Launcher, you can turn it on for the home screen under Action 3 Settings > Desktop > Text Labels. You cannot turn on app labels for the dock in Action Launcher 3 at this time.

The other launcher requirement we have is that it supports third-party icon packs so we get some lovely squircles on our home screens.

Icons

No one icon pack quite gets the S9’s blend of squircles and wireframe icons perfect, so I am going to offer you a few options and let you decide which one is the most Samsung-like in your eyes.

Graced UI, Aspire UX and Emptos icon packs

• Graced UI (Free, in-app donations) leans all the way into the wireframe look, with wireframe takes on hundreds and hundreds of third-party apps, all on squircle icons. Most of the icons have solid colored icons, but some icons feature gradient squircles which allowing them to pop against colorful wallpapers and busy app drawers. The wireframe look can get a little hard to recognize at times,
• Aspire UX S9($0.99) leans away from the wireframe look, giving you wireframe system icons while opting to be more faithful to third-party icons, adapting them to squircles rather than making them completely wireframe. It gives you the Samsung look without going completely wireframe.
• Emptos($0.99 is an icon pack that eschews wireframes altogether and instead opts for uniform white icons on transparent squircles. This allows the lovely wallpapers to shine through and present a clean take on the Samsung look.

Widgets

The TouchWiz home screen by default has two widgets on it: a Google search widget at the bottom of the desktop, and a clock widget top center. Google search widgets are a dime a dozen, and they’re found on just about every launcher on the market today, but that clock widget takes a little extra work.
KWGT Pro is a make-it-yourself widget engine that allows enterprising themers to make widgets however they want and then share their successful widgets with other users. One extra-enterprising themer cobbled together a series of smooth, Samsung-inspired widget presets into a pack and put it up on Google Play for other users to enjoy as S8 for KWGT

To use one of the widgets from S8 for KWGT, add a blank KWGT Pro widget to your home screen, then select the Preset you want. You can even adjust the colors or scale of the widget to better fit your wallpaper and theme.

Download: S8 for KWGT ($1.49)

Your turn

So, what makes the perfect S9 theme to you? Is it the Samsung wallpapers or the squircle icons? Is it the gestures or the widgets? How do you build your own Samsung theme? Show us in the comments!

Samsung Galaxy S9 and S9+

• Hands-on with the Samsung Galaxy S9 and S9+
• Galaxy S9 and S9+: Everything you need to know!
• Complete Galaxy S9 and S9+ specs
• Galaxy S9 vs. iPhone X: Metal and glass sandwiches
• Galaxy S9 vs. Google Pixel 2: Which should you buy?
• Join our Galaxy S9 forums

Verizon
AT&T
T-Mobile
Sprint

This 20000mAh Car Jump Starter features a USB-C port with Power Delivery for $72

This is a must-have.

The iClever 30W 20000mAh car jump starter is basically a huge portable battery which can even charge your MacBook or Nintendo Switch. Using coupon code ABCD3366 you can pick one up for just $71.99, which is nearly $20 off its regular price. It’s designed for vehicles with up to 8L gas or 6.5L diesel engines and can jump them up to 40 times with its included 800A current heavy-duty metal clamps.

It also features a USB-C port with Power Delivery which can quick charge your Nintendo Switch or smartphone. Quick Charge 3.0 is included for compatible devices as well as safety features like polarity protection, over-current protection, and over-charge protection.

Almost 300 Amazon reviewers rated this product with a collective 4.6 out of 5 stars. iClever includes an 18-month warranty in case the product doesn’t work as advertised.

See at Amazon

LWP+ lets you force Android 8.1 Oreo’s dark theme with any wallpaper

Because who doesn’t want dark mode all the time?

Google introduced a lot of fun software goodies with the Pixel 2, one of which is a dark theme that can be enabled depending on which wallpaper you’re rocking. If you add a dark enough wallpaper to your home screen, Android’s stark white paint job in the quick settings, app drawer, folder backgrounds, and Google Feed page is replaced with a sleek, dark/black look.

This is a great step in the right direction for deeper user customization, but thanks to a new app called “LWP+”, you can enable this dark mode with any wallpaper that you’d like.

After downloading LWP+, open the app, select the background image/wallpaper you want, enable the “Set as current live wallpaper” toggle at the top, and you’ll instantly be rocking Android’s dark mode.

I’ve been using the app just fine on my Pixel 2, but keep in mind you’ll need to be running Android 8.1 or later in order for this to work.

LWP+ does give you the option of using custom primary, secondary, and tertiary colors, but I haven’t been able to get this working even after multiple tries.

LWP+ weighs in at just 1.34MB, and for folks that want to use a dark mode 24/7, it’s more than worth taking a look at.

Download: LWP+ (free)

Tim Cook Shares Colorful ‘Shot on iPhone’ Photos From Hindu Festival of Holi

Apple CEO Tim Cook this morning tweeted a series of images that celebrate the Hindu festival of Holi, which began on March 1 and ended today, March 2.

Cook shared three images from the India-based festival, taken by photographers Prashanth Viswanathan, Amit Mehra, and Ashish Parmar. Cook noted that each image was shot on the iPhone X.

Stunning photos that capture the colorful festival of Holi by @prashvish in Nandgaon, @amitmehraphoto in Vrindavan and @ashishjparmar in Bengaluru, India #ShotoniPhone #iPhoneX pic.twitter.com/ykSNJDGvAl

— Tim Cook (@tim_cook) March 2, 2018

Each image depicts people participating in Holi’s colorful festivities, which mark the end of winter and beginning of spring. The festival is largely celebrated within India, but events expand beyond India into the United Kingdom, United States, South Africa, and more.

Two of the images use Portrait Lighting on the iPhone X, a feature that provides several unique lighting effects as a way to emphasize part of an image. Both of the pictures from the Holi festivities use the “Stage Light” effect, which spotlights a subject against a dark background.

Check out Cook’s tweet to see all of the pictures shared from Holi.

Tags: Tim Cook, Shot on iPhone
Discuss this article in our forums

Browsing the web in Google Daydream

If you are willing to use unstable versions, you can get some cool new features

Google has been working to make Chrome on Android a viable browser for their Daydream VR for months now, slowly adding features to the app to make it more VR friendly, all the while holding off on actually making it a Daydream Ready app.

Since Chrome 61 you could put your Daydream ready phone into your View with the Chrome tab open and the page will be viewable when you put the headset on but viewing was really all you could do. The Keyboard didn’t work to let you browse, you couldn’t change anything at all, it was simply a viewer. That all changes with the latest unstable Chrome Canary.

What is Chrome Canary

Chrome Canary is an unstable, test bed for Google Chrome. For android there are essentially three different Chrome apps; Chrome, the stable app, Chrome Beta, mostly stable with some experimental features, and Chrome Canary, unstable and very experimental. To be clear Canary is really bad at being your daily browser on your phone, which is why it doesn’t replace your normal chrome app, what it does is let you experiment with things that Google are hoping might work. So let’s jump in on how to get these features.

More: Make your own Google Daydream View

Step by step

Download Chrome Canary
Open Canary and navigate to chrome://flags
Scroll down to the WebVR section
Enable all the VR things!! Especially Chrome icon in Daydream Home
Restart Chrome Canary
Put your phone in your Daydream View and launch Daydream
Select Chrome Canary and browse the web.

The details

As you can see from the step by the step it isn’t a difficult process. There is a slight risk that Chrome Canary might stop working if you activate some of these features but don’t worry, nothing you do here can hurt your phone.

Once you have downloaded Chrome Canary you can navigate over to chrome://flags to play around. You can browse through all of these experimental features and enable ones you like the look of, but we are focused on the WebVR section about halfway down.

Here’s a tip; search for webVR using the inbuilt search function, enable it then clear the search results. Now it will be easy to scroll down at speed until you see the blue enabled box.

You can enable all the VR parts in Canary but the most important one is Chrome icon in Daydream Home, that’s the one that will allow you to use Chrome in your VR.

So what can I do with it?

Now it’s simply a case of putting your phone in your Daydream View and navigating to Chrome Canary on the home screen. From there you can browse the web to your heart’s content. Well almost. While using this method at least gives you some browsing ability it isn’t perfect. Unlike Chrome 61 you can at least browse using the URL line and the VR keyboard, this lets you choose a website and navigate around it but that’s about it.

There isn’t really a lot else you can do except move the window around in the display. That ability does give me hope, however, if you can move it now it suggests you will be able to resize it at some point in the future or, even more exciting, have more than one website open at the same time.

Basic but it’s a start

What do you guys think? how would you like to see this progress? I am still not sure how browsing in VR will pan out, I’m hoping for Minority Report but thats a long shot. Let us know what you think in the comments.

Google Daydream

• Daydream View review
• The ultimate guide to Daydream
• These phones support Daydream VR
• Every Daydream app you can download
• Catch up with Daydream in the forums!

Google

The Galaxy Note 9 needs a new design to make it special again

Samsung needs more than a stylus to separate the Note from the Galaxy S9+.

We’ve seen the Galaxy S9 now, as well as the bigger and bolder S9+. Samsung once again made a phone that most people wanted them to make, they will sell in the tens of millions and come summer we’ll start hearing about the new Galaxy Note for 2018. Unless Samsung has some grand ideas for the Note 9 I think this year could see the company selling fewer of them than last year.

They’ll still sell plenty, more than enough to make a nice profit. Of this I’m sure. But the Note isn’t Samsung’s mainstream model. The company doesn’t forecast it to sell as well as the Galaxy S because it’s designed for a smaller audience that needs or just wants a little more. And unless the “little more” that people want is a stylus, the Galaxy S9+ already offers it.

The Galaxy S9+ offers everything we expect to see in a Galaxy Note, except a stylus.

Samsung certainly knows how to change things up. This year, we’ll finally get to see some sort of foldable phone, and of course, it comes from Samsung; no other company can build, market and sell a phone like the Galaxy X. I’m not sure how successful it will be or how many people really want a phone that folds in the middle, but I do know the Note used to be that phone where Samsung takes chances, and now it’s the Galaxy X. At least, we haven’t heard any early rumors that make us think there will be chances taken with the Note in 2018.

Pictured, Galaxy S6 edge plus and Galaxy Note 5.

This isn’t a bad place to be. When a product line is popular enough to have as much overlap with another product, and both still sell well, that’s just more money in the bank each quarter without any extra stress on a product team. And since the Galaxy S6 edge+ showed up in 2015, the two high-end product lines from Samsung have been slowly converging. There’s probably a book to be written here by some management person at Samsung about how to pull it off. I’d read it. But the Galaxy S9+ goes a little further into Note territory than we’ve seen before with its dual camera setup and higher RAM count, and really the only difference between it and a “typical” release from the Note line is a stylus.

If any company can make us go “wow” it’s Samsung. I want to go “wow” as much as you do.

That has me thinking Samsung has something in store with the Note 9 that makes us go wow again. No, I’m not talking about a fingerprint scanner built into the screen assembly, but something new. There are a lot of things Samsung could try with the Note 9; they could go the premium audio route, or look at some Moto Mods and build extra functionality like a projector into the phone body (it did this before with the Galaxy Beam and it turned out rather well). Or it can do something nobody has thought of before because Samsung’s pretty good at turning an idea from outlandish to mainstreamish. Nobody thought a phone as big as a tablet would sell, especially one with a little stylus in it; we stopped using Palm Pilots years before.

Or maybe this is more wishful thinking because I want to see cool new things, just like a lot of you want to see cool new things. We should start hearing serious rumors about the Note 9 shortly, and we can try to sort through them and get an idea of what to expect. Here’s hoping what we expect is something we would have never expected before.

Samsung Galaxy S9 and S9+

• Hands-on with the Samsung Galaxy S9 and S9+
• Galaxy S9 and S9+: Everything you need to know!
• Complete Galaxy S9 and S9+ specs
• Galaxy S9 vs. iPhone X: Metal and glass sandwiches
• Galaxy S9 vs. Google Pixel 2: Which should you buy?
• Join our Galaxy S9 forums

Verizon
AT&T
T-Mobile
Sprint

I use my phone in the shower — don’t judge, just listen

This isn’t some weird phone addiction thing, I promise.

I travel a fair bit. Sometimes just for fun, but usually for work. When I travel for work, I’m usually fairly burned out by the end of the day. I’m not much of a drinker (or smoker, for that matter) and so I usually turn to my phone to watch something and just sort of detox from the day. It’s usually whatever show I would normally be watching at home, or whatever I downloaded from Netflix before getting on the plane.

Now that it’s super common for phones to be waterproof, my phone has started coming with me into the bath or shower and it’s made my travel life a lot nicer.

A lot of my daily routine happens on my phone. I usually listen to a podcast or the morning show from my favorite radio station back home as I go for a run or hit the exercise bike in the morning. Standard procedure after that is usually to hit the shower, and when I’m not at home that usually means the phone follows me into the shower so I can keep listening while starting my day. The same basic idea applies to the end of the day, the phone follows me into the shower and I’ll keep watching an episode of Altered Carbon or something while I take care of business.

I relax a lot faster at the end of the day now.

This is abnormal behavior for me. I don’t feel the need to behave this way when I’m at home, though I think mostly that’s due to not wanting to wake someone up at the beginning or end of the day in my house. But for whatever reason, my phone doesn’t come anywhere near the bathroom when I’m at home. When I’m traveling, though, I find adding my phone to the shower to be a rewarding bit of self-care. I relax a lot faster at the end of the day, which usually leads to me doing more work instead of going to sleep, but that’s another matter entirely.

It’s also worth pointing out just how well these phones are built for this environment now. My Pixel 2 is not only waterproof, but the stereo front-facing speakers make it perfect to prop up in those hotel soap dishes that are almost always at eye level. Now that the Galaxy S9 and S9+ are creating that stereo effect with the combination of the headphone speaker and the bottom-firing speakers, that is likely also going to be a great experience for in-shower entertainment.

If you’ve never given this a shot, go for it next time you’re able. This isn’t as crazy as it sounds, shower speakers have been a thing for a long time now. This just cuts out the middle gadget and as an added bonus lets you catch up on your shows a little faster. Or maybe I’m the only one who does this and I’m a big weirdo for admitting it. Either way, give it a try. You’ll probably like it.

Samsung Galaxy S9 and S9+

• Hands-on with the Samsung Galaxy S9 and S9+
• Galaxy S9 and S9+: Everything you need to know!
• Complete Galaxy S9 and S9+ specs
• Galaxy S9 vs. iPhone X: Metal and glass sandwiches
• Galaxy S9 vs. Google Pixel 2: Which should you buy?
• Join our Galaxy S9 forums

Verizon
AT&T
T-Mobile
Sprint

The Light Phone 2 is an ultra-minimalistic phone that only does the basics

For someone who’s always in front of a screen, this looks like a dream come true.

Smartphones are awesome. I love my Pixel 2 and use it daily for taking photos, browsing social media, watching YouTube videos, etc. However, as awesome as it is, it can also be a distraction I don’t always need. This is a struggle that a lot of people have, and to provide a solution to this problem, we have the Light Phone 2.

Light Phone 2 is a project that recently launched on Indiegogo, and it’s a 4G LTE phone that does the basics and nothing more. You can make phone calls, send text messages, view your contacts, and even set alarms, but you won’t find any apps for social media, emails, news, or games.

All of this is packed into a small, rectangular body (99mm x 55mm x 7.5mm) with an e-Ink display, and it’s powered by LightOS – a heavily modified version of Android.

The Light Phone 2 will have a price tag of $400 USD, but if you act fast, you can still grab it for $250 as part of the Indiegogo campaign.

So, why in the world would anyone want to throw down $250 to $400 on a phone that makes calls and texts but not much else? For me personally, this looks like something I’d love to have.

I try to be as conscious as possible about my smartphone usage, but it’s still something I struggle with each day. I can be spending time with family or my fiance, and before you know it, I’ve got my phone in my hand going through Twitter or checking out Instagram Stories. With the Light Phone 2, there’s no chance for those distractions to happen. I don’t think I could ever completely get rid of my Pixel 2 due to the nature of my job, but for those times when I really want to stay in the moment, the Light Phone 2 would be wonderful to have as a secondary device.

The team behind Light Phone 2 says it’s toying with other features it may add down the road, such as turn-by-turn directions, ride-sharing, weather info, etc., but anything that does get added will have a purpose. No matter what happens, you’ll never see an app for Facebook on here.

Light Phone 2 is slated to start shipping in April 2019, and at the time of publishing this article, the campaign’s already 169% complete with over $420,000 in raised funds.

This is definitely something I’ll be following over the next year, but what about you? Is the Light Phone 2 something you’d be interested in buying? Let me know in those comments down below.

See at Indiegogo