By continuing to use the site or forum, you agree to the use of cookies, find out more by reading our GDPR policy

After tearing the PlayStation 5's guts apart earlier this week, Sony confirmed nearly everything we'd like to know on Friday about how its new console, launching November 12, will interface with PS4 games via backward compatibility. We should probably start with the big news that Sony has not cleared up just yet. Today, we received our first indication that PlayStation 5 will ship with something known as "Game Boost," which its Friday news post suggests "may make [select] PS4 games run with a higher or smoother frame rate." This suggestion doesn't come with a handy footnote pointing us to a list of affected games or features, however. Sony did not immediately respond to our request for clarification, so I'm left pointing to my recent deep dive with Xbox Series X's backward compatibility suite. What I found there was compelling: Most games play nearly identically on Xbox Series X as they do on Xbox One X, since console games are typically coded with hard limits on technical aspects. But in the case of games that launched on PS4 with "unlocked" frame rates and dynamic resolutions, well, the sky might be the limit. Will PS5 let those older, uncapped games tap into the full PS5 architecture or will certain CPU and GPU aspects be limited for compatibility's sake? I found that Xbox Series X was generally quite generous to the minority of games that could tap into increased horsepower, but there's no guaranteeing Sony will treat its older games the same way, in order to prioritize compatibility over upgrades. Additionally, will current-gen PlayStation VR games see their own boosts? "PSVR" is referenced repeatedly throughout today's new document but not in the brief mention of Game Boost. Existing PlayStation VR hardware seems to be entirely compatible with PS5, with Sony confirming once again that users will need a PlayStation Camera adapter to connect to PS5—and that those adapters will be free. How exactly PSVR owners will get those adapters remains to be seen. The matter of PS5 controller compatibility is a bit more complicated than Xbox Series' pledge of total forward and backward compatibility (with the exception of Xbox One Kinect, RIP). As has previously been hinted, PS5's new DualSense controller will work with older games, but PS4's DualShock 4 gamepad will not work with PS5 games. (Yes, you can still connect a PS4 DualShock 4 to play PS4 games on PS5. Whew, that's a mouthful.) In good forward-compatibility news, if you already bought an expensive add-on controller, Sony assures you that "specialty peripherals [from the PS4 era], such as officially licensed racing wheels, arcade sticks, and flight sticks," will work with PS5 software. When playing the PS4's library of PSVR games on PS5, Sony encourages users to stick with DualShock 4 as a gamepad, suggesting that the older gamepad offers the "best experience" in PSVR. This implies, but doesn't confirm, that DualSense will not work the same way as a DualShock 4 in PSVR games like Astro Bot, which relies heavily on gamepad motion sensing via tracking elements like its "light bar." You can also use existing PlayStation Move wands in PSVR games on PS5. Certain PS4 system features have been scrapped when moving forward to PS5. The DualShock 4's "share" button now brings up the PS5's built-in "create" menu, which appears to do all the stuff that "share" did on PS4 but with a few additional button shortcuts. And PS4 social features like tournaments, "in-game live," and second-screen app functionality have all gotten the axe. Complete details are posted on OUR FORUM.

Fortnite won’t be coming back to the App Store any time soon. On Friday, Judge Yvonne Gonzales Rogers refused to grant Epic Games a preliminary injunction against Apple that would force the game developer to reinstate Fortnite on the App Store, while simultaneously granting an injunction that keeps Apple from retaliating against the Unreal Engine, which Epic also owns. In other words, we now have a permanent version of the temporary restraining order ruling from last month. That means the state of affairs, in which Epic is banned from publishing new games on iOS and cannot distribute Fortnite on the App Store in its current form, will remain in place for the length of the trial — unless Epic decides to remove its own in-app payment mechanism that initiated the bitter legal feud in August. Rogers had previously suggested a jury trial might be appropriate as soon as next July, but ahead of today’s ruling, both parties said they would rather have the case decided by a judge. Today’s decision still prevents Apple from revoking Epic’s developer tools in a way that could have harmed its broader business. “Epic Games and Apple are at liberty to litigate this action for the future of the digital frontier, but their dispute should not create havoc to bystanders. Thus, the public interest weighs overwhelmingly in favor of Unreal Engine and the Epic Affiliates,” said the judge, keeping Epic’s Unreal Engine business from being harmed. “Epic Games is grateful that Apple will continue to be barred from retaliating against Unreal Engine and our game development customers as the litigation continues,” an Epic spokesperson said in a statement. “We will continue to develop for iOS and Mac under the court’s protection and we will pursue all avenues to end Apple’s anti-competitive behavior.” “Our customers depend on the App Store being a safe and trusted place where all developers follow the same set of rules,” an Apple spokesperson said in a statement. “We’re grateful the court recognized that Epic’s actions were not in the best interests of its own customers and that any problems they may have encountered were of their own making when they breached their agreement. For twelve years, the App Store has been an economic miracle, creating transformative business opportunities for developers large and small. We look forward to sharing this legacy of innovation and dynamism with the court next year.” Apple and Epic met in federal court again in September for another round, where the merits of the Fortnite developer’s antitrust case against Apple were argued before Rogers for a second time since Epic filed its lawsuit in August. Epic had a particularly rough go of it, as Rogers singled out the company for what she characterized as dishonest behavior that may prove the company poses a security risk to the iOS platform. “You did something, you lied about it by omission, by not being forthcoming. That’s the security issue. That’s the security issue!” Rogers told Epic, according to a report from CNN. “There are a lot of people in the public who consider you guys heroes for what you guys did, but it’s still not honest.” Rogers also brought up the fact that walled gardens and their standard 30 percent cuts are commonplace in the game industry, with console makers like Microsoft, Nintendo, and Sony implementing similar rules. Rogers said the case should likely go to a jury to decide and suggested a trial time frame of next summer. “It is important enough to understand what real people think,” said Rogers. “Do these security issues concern people or not?” The other benefit of a jury trial is that it may result in a stickier, more definitive ruling. The likelihood this case sees numerous appeals is high, and appellate courts are more likely to uphold a jury decision when appealed. That could avoid the case bouncing between courts for years to come. “I know I’m just a stepping stone for all of you,” Rogers added. Learn more by visiting OUR FORUM.

According to the complaint which was voiced at a closed-door meeting of the World Trade Organization (WTO), China’s trading partner was taking measures that are “clearly inconsistent with WTO rules, restrict cross-border trading services and violate the basic principles and objectives of the multilateral trading system”, RT reported. The US said at the meeting that its action against Chinese apps was in defense of its national security. It has pointed to the WTO’s General Agreement on Services which allows for such action in cases “relating to the supply of services as carried out directly or indirectly for the purpose of provisioning a military establishment”. China has argued that TikTok’s data collection was standard practiсe for thousands of apps worldwide and that Washington’s actions were a “clear abuse” of the relevant articles. US President Donald Trump has accused TikTok of threatening America’s national security and gathering data for Beijing via the app’s parent company ByteDance. Both Beijing and the firm denied those allegations. Trump has targeted the popular Chinese apps with a series of orders that aim to ban US entities from doing business with them or downloading them from American app stores. In addition, the Trump administration wants to force the sale of TikTok to a US buyer by November 14. ByteDance has already started discussing the transfer of the app’s ownership to US tech giant Oracle. A new company, TikTok Global, would oversee US operations. Trump has approved the deal, which, according to him, will provide “100 percent” security.
Via fna, Pic archive

The modular and most adaptive version of Windows 10 is currently called ‘Windows 10X’ and it’ll be arriving on traditional single-screen laptops in the first half of 2021. Windows 10’s modular version was first announced in October 2019 and Microsoft originally said that the Surface Neo would be the first device to run the new OS. However, everything has changed after Microsoft started preparing Windows 10X for single-screen devices in an effort to meet the current needs of the customers. Microsoft has also removed the Surface Neo listing to clarify it’s not coming this holiday season. At the moment, we’re not sure if Microsoft will publish the beta builds of Windows 10X to the testers in the Insider, which raises fresh questions and concerns about exactly how the OS might work. Windows 10X is also known as Windows Lite internally and it’s based on Windows Core OS, which modularizes Windows Shell and other components. This new operating system is designed to run on both single-screen and dual-screen form factors, and it’s also modern without legacy components. In addition, Windows 10X comes with a new user interface that ditches live tiles support for icons and it also allows Windows Update to happen seamlessly in the background. According to sources, Microsoft is currently planning to deliver Windows 10X sometime in the first half of 2021 without native support for Win32 apps. The first single-screen Windows 10X PCs are also set to arrive in the second quarter or Spring of 2021. To make room for Windows 10X launch, Microsoft also appears to be considering changes to its Windows 10 upgrade cycle. Going forward, Windows 10 will receive only one feature update per year and next year’s feature update is expected to arrive after Windows 10X launches in the market. After the launch of Windows 10X in Q2 2021, Microsoft will begin rolling out the first feature update for Windows 10. In the spring of 2022, we’ll see the first big Windows 10X feature update that will add support for dual-screen hardware, such as Surface Neo and Lenovo ThinkPad Fold. Unfortunately, Microsoft has reportedly removed the virtualization technology from the internal builds of Windows 10X. This would have allowed Win32 apps (desktop or classic apps) to run smoothly in a container. Microsoft is not satisfied with the performance of Win32 apps on Windows 10X due to limitations. For example, some Win32 apps are struggling to access the native features available outside the container, which includes screen sharing and alerts when apps are minimized to the taskbar. This is the opposite of the Windows 10X ethos, which is supposed to offer both performance and compatibility at the same time. As a result, Windows 10X internal builds have dropped support for Win32 apps. You can only run UWP and web apps natively, which would turn Windows 10X into a proper lightweight OS for Chromebook-like devices. Microsoft will allow early adopters to stream Win32 apps via a web service, which works only when you have an internet connection. While the plans are always subject to change, Microsoft has internally decided not to move forward with the dual-screen model for another year. For more on this visit OUR FORUM often.

FEDERAL AGENTS from the Department of Homeland Security and the Justice Department used “a sophisticated cell phone cloning attack—the details of which remain classified—to intercept protesters’ phone communications” in Portland this summer, Ken Klippenstein reported this week in The Nation. Put aside for the moment that, if the report is true, federal agents conducted sophisticated electronic surveillance against American protesters, an alarming breach of constitutional rights. Do ordinary people have any hope of defending their privacy and freedom of assembly against threats like this? Without more details, it’s hard to be entirely sure what type of surveillance was used, but The Nation’s mention of “cell phone cloning” makes me think it was a SIM cloning attack. This involves duplicating a small chip used by virtually every cellphone to link itself to its owner’s phone number and account; this small chip is the subscriber identity module, more commonly known as SIM.  SIM cards contain a secret encryption key that is used to encrypt data between the phone and cellphone towers. They’re designed so that this key can be used (like when you receive a text or call someone) but so the key itself can’t be extracted. But it’s still possible to extract the key from the SIM card, by cracking it. Older SIM cards used a weaker encryption algorithm and could be cracked quickly and easily, but newer SIM cards use stronger encryption and might take days or significantly longer to crack. It’s possible that this is why the details of the type of surveillance used in Portland “remain classified.” Do federal agencies know of a way to quickly extract encryption keys from SIM cards? (On the other hand, it’s also possible that “cell phone cloning” doesn’t describe SIM cloning at all but something else instead, like extracting files from the phone itself instead of data from the SIM card.) Assuming the feds were able to extract the encryption key from their target’s SIM card, they could give the phone back to their target and then spy on all their target’s SMS text messages and voice calls going forward. To do this, they would have to be physically close to their target, monitoring the radio waves for traffic between their target’s phone and a cell tower. When they see it, they can decrypt this traffic using the key they stole from the SIM card. This would also fit with what the anonymous former intelligence officials told The Nation; they said the surveillance was part of a “Low-Level Voice Intercept” operation, a military term describing audio surveillance by monitoring radio waves. Even if law enforcement agencies don’t clone a target’s SIM card, they could gather quite a bit of information after temporarily confiscating the target’s phone. They could power off the phone, pop out the SIM card, put it in a separate phone, and then power that phone on. If someone sends the target an SMS message (or texts a group that the target is in), the feds’ phone would receive that message instead of the target’s phone. And if someone called the target’s phone number, the feds’ phone would ring instead. They could also hack their target’s online accounts, so long as those accounts support resetting the password using a phone number. But, in order to remain stealthy, they would need to power off their phone, put the SIM card back in their target’s phone, and power that phone on again before returning it, which would restore the original phone’s access to the target’s phone number, and the feds would lose access. Read this entire posting on OUR FORUM.

Researchers have uncovered a threat group launching surveillance campaigns that target victims’ personal device data, browser credentials, and Telegram messaging application files. One notable tool in the group’s arsenal is an Android malware that collects all two-factor authentication (2FA) security codes sent to devices, sniffs out Telegram credentials, and launches Google account phishing attacks. Researchers found the threat group, dubbed Rampant Kitten, has targeted Iranian entities with surveillance campaigns for at least six years. It specifically targets Iranian minorities and anti-regime organizations, including the Association of Families of Camp Ashraf and Liberty Residents (AFALR); and the Azerbaijan National Resistance Organization. The threat group has relied on a wide array of tools for carrying out their attacks, including four Windows info-stealer variants used for pilfering Telegram and KeePass account information; phishing pages that impersonate Telegram to steal passwords; and the aforementioned Android backdoor that extracts 2FA codes from SMS messages and records the phone’s voice surroundings. “Following the tracks of this attack revealed a large-scale operation that has largely managed to remain under the radar for at least six years,” said researchers with Check Point Research, in a Friday analysis. “According to the evidence we gathered, the threat actors, who appear to be operating from Iran, take advantage of multiple attack vectors to spy on their victims, attacking victims’ personal computers and mobile devices.” The Attacks Researchers first discovered Rampant Kitten’s campaign through a document, the title of which translates to “The Regime Fears the Spread of the Revolutionary Cannons.docx.” It’s unclear how this document is spread (via spear-phishing or otherwise), but it purports to describe the ongoing struggle between the Iranian regime and the Revolutionary Cannons, an anti-regime, Mujahedin-e Khalq movement. The document when opened loads a document template from a remote server (afalr-sharepoint[.]com), which impersonates a website for a non-profit that aids Iranian dissidents. It then downloads malicious macro code, which executes a batch script to download and execute a next-stage payload. This payload then checks if the popular Telegram messenger service is installed on the victims’ system. If so, it extracts three executables from its resources. These executables include an information stealer, which lifts Telegram files from the victim’s computer, steals information from the KeePass password-management application, uploads any file it can find which ends with a set of pre-defined extensions, and logs clipboard data and takes desktop screenshots. Researchers were able to track multiple variants of this payload dating back to 2014. These include the TelB (used in June and July 2020) and TelAndExt variants (May 2019 to February 2020), which focus on Telegram; a Python info stealer (February 2018 to January 2020) that is focused on stealing data from Telegram, Chrome, Firefox and Edge; and a HookInjEx variant (December 2014 to May 2020), an info stealer that targets browsers, device audio, keylogging and clipboard data. During their investigation, researchers also uncovered a malicious Android application tied to the same threat actors. The application was purporting to be a service to help Persian speakers in Sweden get their driver’s license. Instead, once victims download the application, the backdoor steals their SMS messages and bypasses 2FA by forwarding all SMS messages containing 2FA codes to an attacker-controlled phone number. “One of the unique functionalities in this malicious application is forwarding any SMS starting with the prefix G- (The prefix of Google two-factor authentication codes) to a phone number that it receives from the C2 server,” said researchers. “Furthermore, all incoming SMS messages from Telegram, and other social network apps, are also automatically sent to the attackers’ phone number.” Of note, the application also launches a phishing attack targeting victims’ Google account (Gmail) credentials. The user is presented with a legitimate Google login page, inside Android’s WebView. In reality, attackers have used Android’s JavascriptInterface to steal typed-in credentials, as well as a timer that periodically retrieves the information from the username and password input fields. We have more of this posted on OUR FORUM.