A couple of years ago, the tech world was abuzz about the cloud. Cloud computing refers to computing where the processing or storage takes place on a networked series of computers rather than on the device that you’re using. Whether you’re using a PC, laptop, tablet, smartphone, television, or video game console, everything now connected to Cloud Storage and always in sync.

But there is a limitation, that smartphones can essentially remember deleted information, which poses a huge risk to organizations that issue smartphones to employees and to organizations that don't explicitly disable the use of personal devices for work-related computing.

Researchers at the University of Glasgow found that cloud storage apps that say they send files to the cloud also leave retrievable versions of files on the devices. They tested some cloud-based file storage systems tested included Box, Dropbox and SugarSync on HTC Desire, running Android 2.1, and an iPhone 3S running iOS 3. They found that Smartphone devices which access cloud storage services can potentially contain a proxy view of the data stored in a cloud storage service.

If the cloud storage application has been used to view the files in the cloud and later user has not attempted to clear the cache of recently viewed files, it can potentially provide a partial view of the data without access to the data provider.

As a Forensic Expert, The recovery of cache data from these devices can in some scenarios provide access to further data stored in a cloud storage account.

The results from the experiment have shown that it is possible to recover files from the Dropbox, Box and SugarSync services using smartphone devices. On the HTC Desire, both deleted and available files were recovered. The forensic toolkits recovered nine files from Dropbox, fifteen from Box and eleven from SugarSync. On the iPhone, depending on application and device manipulation either five or seven files were recovered from Dropbox, seven or fifteen from SugarSync and five from Box.

Also meta-data was recovered from all the applications on both devices. This meta-data included transitional logs containing user activity, meta-data related to the files in the storage service and information about the user of the application.

The paper also suggests more research is needed, because the whole point of cloud storage is access from multiple devices and security of those devices is therefore very important.

Oracle has released emergency patches multiple of times in recent months for Java for one after another set of vulnerabilities. About 100 million computers reported to be vulnerable to unauthorized access via different flaw in Java software. Department of Homeland Security's US-CERT already warned users to disable Java permanently to stop hackers from taking control of users' machines.

Security experts advised,'The best defense we have right now for these kinds of attacks is to disable Java in the browser forever'. According to Websense experts, Most browser installations use outdated versions of the Java plug-in that are vulnerable to at least one of several exploits used in popular web attack toolkit. Exploit kits are a very common tool for distribution of many Java-based threats.

To detect the vulnerable Java versions that are installed on systems and Websense experts, used their technology via 'threat intelligence network', which monitors billions of web requests originating from tens of millions systems.

Websense showed that only 5.5% of Java-enabled browsers have the most up-to-date versions of the software. "It is probably no surprise that the largest single exploited vulnerability is the most recent one, with a vulnerable population of browsers at 93.77%." Charles posted at Websense blog.

"Most browsers are vulnerable to a much broader array of well-known Java holes, with over 75% using versions that are at least six months old, nearly two-thirds being more than a year out of date, and more than 50% of browsers are greater than two years behind the times with respect to Java vulnerabilities."

All this doesn't mean that Java is an insecure language or platform, or that web sites built on Java EE are any less secure than other platforms. Unfortunately, perception often beats reality, and Java is getting a big black eye from this one.

Canonical, the software company that manages and funds Ubuntu, announced to develop a new, open-source operating system customized especially for Chinese users called 'UbuntuKylin OS'.

According to the BBC, Chinese government and Canonical partner to launch its home grown operating system. China signaled its intention to move away from its dependence on western software products i.e windows.

Canonical staff and Chinese researchers will be working on the OS at a Beijing lab. China's Ministry of Industry and Information Technology will collaborate with Canonical to come up with Kylin to run on servers, aimed at websites, online shops, and hosting.

The first version of Ubuntu Kylin is for the laptops and desktops. Therefore the Android dominates the Chinese market for a few more years. The Ubuntu Kylin is not for the mobile device because Canonical already has the Ubuntu Mobile OS.

Future releases will also include integration with Baidu maps and shopping service Taobao, payment processing for Chinese banks, and real-time train and flight information. WPS Office, known outside China as Kingsoft Office or KSOffice may eventually land in Ubuntu Kylin as the default productivity suite.

The first Ubuntu Kylin release for Chinese users is expected next month with 13.04. You can like ourFacebook page or follow us on Twitter or add us to your circle in Google + so that you won’t miss out any breaking Hacking news.

Apple is beefing up the security of its iCloud and Apple ID accounts by adding two-factor authentication to the account login process. Users who activate the option will be required to enter a four-digit code they may receive via SMS 

message, aside from the usual password.

Two-factor authentication is gaining popularity because it makes login to online services significantly more secure compared to regular process. Apple has rolled out this functionality for Apple ID and iCloud users.

"Turning on two-step verification reduces the possibility of someone accessing or making unauthorized changes to your account information at My Apple ID or making purchases using your account," Apple said.

Apple will be using both the app and SMS versions, providing security codes through texts as well as the FindMyiPhone app. As long as users are able to remember their password, they will have the ability to generate a new recovery key from the My Apple ID website.

Two-factor authentication is gaining popularity because it makes login to online services significantly more secure compared to regular process. Apple has rolled out this functionality for Apple ID and iCloud users.

"Turning on two-step verification reduces the possibility of someone accessing or making unauthorized changes to your account information at My Apple ID or making purchases using your account," Apple said.

Apple will be using both the app and SMS versions, providing security codes through texts as well as the FindMyiPhone app. As long as users are able to remember their password, they will have the ability to generate a new recovery key from the My Apple ID website.

• Two-factor authentication is gaining popularity because it makes login to online services significantly more secure compared to regular process. Apple has rolled out this functionality for Apple ID and iCloud users.
  
  
  "Turning on two-step verification reduces the possibility of someone accessing or making unauthorized changes to your account information at My Apple ID or making purchases using your account," Apple said.
  
  
  Apple will be using both the app and SMS versions, providing security codes through texts as well as the FindMyiPhone app. As long as users are able to remember their password, they will have the ability to generate a new recovery key from the My Apple ID website.
  
  
  You can turn on the feature as described below
  1. Go to My Apple ID (appleid.apple.com)    
  2. Click the "Manage your Apple ID" button to login to your Apple ID
  3. Enter your Apple ID and password and click "Sign In"
  4. Select "Password and Security" in the left-hand column
  5. Type in the answers to your account security questions if you are prompted to answer them.
  6. You will see Two-Step Verification at the top of the page. Click on "Get Started" and follow the on-screen instructions.
  The option will be initially available in the United States, United Kingdom, Australia, Ireland, and New Zealand. Other countries will be added later.

T-Mobile devices having a default Wi-Fi Calling feature that keeps you connected in areas with little or no coverage using Wi-Fi connection. But according to new finding by students Jethro Beekman andChristopher Thompson from University of California Berkeley, that this feature lets millions of Android users vulnerable to Man-in-the-Middle attack.

The simplest way to become a man-in-the-middle would be for the attacker to be on the same open wireless network as the victim, such as at a coffee shop or other public space.

In a technical analysis of the exploit, The flaw could potentially allow hackers to access and modify calls and messages made by T-Mobile users on certain Android smartphones. Beekman and Thompson informed T-Mobile, a division of Deutsche Telekom, of the flaw in December and on March 18 T-Mobile was able to resolve the issue for all affected phone models.

T-Mobile uses regular VoIP for Wi-Fi Calling instead of a connection that encrypted, something that aids in its vulnerability. The certificate validation had not been fully implemented, so without this proper verification, hackers could have created a fake certificate and pretend to be the T-Mobile server.

T-Mobile released a security update to its Android users on March 18 that resolved the issue. Other carriers around the world have similar features enabled on some smartphones, including Rogers Wireless in Canada and Orange in Britain.

Yesterday we reported about a massive Cyber attack on South Korea that was responsible for shutting down networks of South Korean banks and TV broadcasters. Police are still investigating the cyber attack  but the country's Communications Commission has revealed that the hacking originated from a Chinese IP address.

Symantec Security team analyze the code used in the cyber attacks against South Korea and they discovered an additional component used in this attack that is capable of wiping Linux machines. 

The malware, which it called Jokra, contains a module for wiping remote Linux machines. 'The included module checks Windows 7 and Windows XP computers for an application called mRemote, an open source, multi-protocol remote connections manager.' Symantec said.

McAfee also published an analysis of the attack code, which wrote over a computer's master boot record, which is the first sector of the computer's hard drive that the computer checks before the operating system is booted. If the MBR is corrupted, the computer won't start.

'The malware specifically looks for login credentials saved by two specific SSH clients: mRemote and SecureCRT. It uses any stored root credentials to log into remote Linux servers: for AIX, HP-UX, and Solaris servers it deletes the MBR. If it is unable to delete the MBR, it instead deletes various important folders.' Trend Micro said in their report.

The malware also attempts to shut down two South Korean antivirus products made by the companies Ahnlab and Hauri.

The bash script is a wiper designed to work with any Linux distribution, with specific commands for SunOS, AIX, HP-UX distributions. It wipes out the /kernel, /usr, /etc, and /home directories.

A previous cyberattack on South Korea had been traced to North Korea using a Chinese IP address. At the time, North Korea blamed the US for the hacking. Officials stressed that the IP address did not reveal who was behind the attack, as hackers can route their attacks through addresses in other countries to obscure their identities.

The US government is claiming that authorities do not need court warrants to affix GPS devices to vehicles to monitor their every move. t's been more than a year since a Supreme Court decision established that affixing a GPS tracking device to a vehicle constitutes a search under the constitution.

The decision, United States vs. Jones, throws out the drug-related conviction of nightclub owner Antoine Jones.

The GPS locator was installed the day after the warrant expired and while the vehicle was outside of the department's jurisdiction, and DC police tracked Jones for nearly a month after installation before arresting him.

"Requiring a warrant and probable cause before officers may attach a GPS device to a vehicle, which is inherently mobile and may no longer be at the location observed when the warrant is obtained, would seriously impede the government's ability to investigate drug trafficking, terrorism, and other crimes. Law enforcement officers could not use GPS devices to gather information to establish probable cause, which is often the most productive use of such devices. Thus, the balancing of law enforcement interests with the minimally intrusive nature of GPS installation and monitoring makes clear that a showing of reasonable suspicion suffices to permit use of a ‘slap-on' device like that used in this case."

Shortly after a 2010 Rite Aid heist, officers tracked the Dodge Caravan and arrested the brothers. Inside the vehicle, they discovered the pharmacy’s surveillance system and drugs in the vehicle that was monitored for 48 hours with a GPS device, Wired reported.

Privacy and civil rights advocates are siding with the Katzin brothers, arguing that GPS tracking is a powerful technology that allows for persistent surveillance and thus needs to be used with caution and oversight.