When you pay for security software, you probably hope it’s protecting you — not creating a massive security breach in and of itself. But if you ran Trend Micro’s password manager, enabled by default for all Trend Micro users, any site on the web could have executed any app on your computer just by including a bit of code.
A patch issued today mostly solves the problem. But as Ars Technica reports, that only happened because Google Project Zero team member Tavis Ormandy publicly berated the company.
“I don’t even know what to say — how could you enable this thing by default on all your customer machines without getting an audit from a competent security consultant?” wrote Ormandy in a long email exchange the company has since made public.
Ormandy claimed it took him “about 30 seconds” to find the vulnerability, and demonstrated it by quickly building a Web page that could remotely launch the Windows calculator if opened on a computer with the password manager installed and running — regardless if users were using it.
That’s true even if you don’t use the password manager, but it gets worse if you do: A related vulnerability made it possible to read all of a users’ saved usernames and passwords in plain text.
A recent update patches the exploit by only allowing Trend Micro sites to send such commands. If you use Trend Micro, make sure everything is up to date, or you might be extremely exposed to all sorts of problems.
But even if you do update, there still could be problems. As of today, Ormandy is saying this “is not sufficient to prevent attacks,” because something like DNS spoofing could trick your computer into thinking a command is coming from Trend Micro. Ormandy added that “a better solution would be to digital sign requests with a certificate.”
Google Project Zero is a team of security researchers inside Google that find zero-day exploits, problems that would otherwise be exploited by hackers. The team gives software companies 30 days to fix the problem, at which point they make it public. The idea is to make the Internet a safer place by getting these exploits fixed before hackers can use them, though this has prompted controversy: Some companies feel this isn’t enough time. It is more time than a hacker would grant, though.
The absolutely absurd idea of putting a touchscreen display on a mouse isn't exactly new. Turtle Beach already did it with its Command Series MC7, which features a 2.25-inch control screen. But apparently, even that wasn't ridiculous enough for Arctic Fox Technologies. Its new Super Mouse looks like someone took the chunky old Atari ST mouse, slapped a touchscreen and scroll wheel on it, and called it an upgrade.
The result is a rather unusual-looking mouse that is now on Kickstarter, starting at $199. And as ridiculous as it looks, some of its features are genuinely intriguing.
Apple is less than a day away from launching its highly anticipated OLED MacBook Pro with a touch-sensitive screen. But it appears that the upgrade is going to cost a pretty penny. According to a report by Bloomberg, Apple is reportedly eyeing a starting price of $2,899 for the 14-inch MacBook Pro, while the 16-inch version could start at $3,399 in the US.
"At $2,899, the 14-inch model would mark the highest starting price for a new MacBook Pro model, surpassing the $2,799 Apple charged for a 17-inch version introduced in 2006," says the report. The report claims that Apple is targeting a minimum price hike of $400 for its upcoming redesigned 14-inch and 16-inch MacBook Pro models.
I've spent a good amount of time digging into the spec sheet of the new M6 MacBook Pro (14-inch), and for all intents and purposes, this is a classic Apple "chip and connectivity" refresh. It's not a full redesign. The chassis, Liquid Retina XDR panel, speakers, ports, and battery, all of them carry over unchanged.
However, the M6 brings more cores, stronger on-device AI, higher memory bandwidth on the larger configs, and modern wireless. Here’s the practical rundown of what actually improved, and whether those gains are worth your money.