Month: March 2022

Enlarge (credit: Getty Images)

A researcher has successfully used the critical Dirty Pipe vulnerability in Linux to fully root two models of Android phones—a Pixel 6 Pro and Samsung S22—in a hack that demonstrates the power of exploiting the newly discovered OS flaw.

The researcher chose those two handset models for a good reason: They are two of the few—if not the only—devices known to run Android version 5.10.43, the only release of Google’s mobile OS that’s vulnerable to Dirty Pipe. Because the LPE, or local privilege escalation, vulnerability wasn’t introduced until the recently released version 5.8 of the Linux kernel, the universe of exploitable devices—whether mobile, Internet of Things, or servers and desktops—is relatively small.

Behold, a reverse shell with root privileges

But for devices that do package affected Linux kernel versions, Dirty Pipe offers hackers—both benign and malicious—a platform for bypassing normal security controls and gaining full root control. From there, a malicious app could surreptitiously steal authentication credentials, photos, files, messages, and other sensitive data. As I reported last week, Dirty Pipe is among the most serious Linux threats to be disclosed since 2016, the year another high-severity and easy-to-exploit Linux flaw named Dirty Cow came to light.

Enlarge (credit: Google)

Stadia’s rumored pivot to a Google Cloud service is real! At the “Google for Games Developer Summit” Tuesday, Google announced that the technology underpinning Stadia will be available for sale as a Google Cloud service called “Immersive Stream for Games.” That’s nowhere near as catchy as the “Google Stream” name that was rumored, but Google Cloud services aren’t consumer-facing anyway.

The company confirmed AT&T was one of the first to trial Immersive Stream for Games last year, when it launched Batman: Arkham Knight as a free streaming game for AT&T mobile subscribers (AT&T owns Batman via DC Comics). Despite giving the game out to mobile subscribers, you aren’t actually supposed to play Batman over your cellular connection just yet—it only works on PCs, not smartphones.

During the keynote, AT&T said it would soon enable playback on a smartphone for the Stadia-powered game. “This technology, paired with the AT&T network, gives us the ability to deliver games directly to customers,” AT&T Vice President of 5G Product & Innovation Jay Cary said during the keynote. “We’re preparing for the launch of our next title on the immersive streaming platform soon.” ISPs like AT&T have an incentive to push cloud gaming since it uses a ton of data and makes users reliant on ISPs for quality access. AT&T does not zero-rate its own services anymore, so this Stadia game will be an easy way to make your cellular bill skyrocket or quickly exhaust your unthrottled data allocation. Cary mentioned that “thousands” of AT&T customers have tried the Stadia-powered game so far.

Enlarge / Dan Ball, host of One America News show Real America. (credit: One America News)

One America News might have to shut down because of DirecTV’s decision to drop the right-wing network from its channel lineup, OAN said in a lawsuit against DirecTV and its owner AT&T.

DirecTV recently said it will drop OAN after their carriage contract expires in early April. DirecTV will also drop AWE (A Wealth of Entertainment), as OAN and AWE are both owned by Herring Networks. In a lawsuit filed on March 7 and reported by the Daily Beast on Friday, Herring Networks alleged that breach of contract and other violations were committed by AT&T, DirecTV, and AT&T Board Chairman William Kennard.

“As a result of the conduct of AT&T, AT&T Services, DirecTV, and Kennard, OAN and AWE might be forced off the air because Herring will no longer be able to broadcast OAN and AWE via DirecTV and Herring presently has limited alternative carriage options,” the lawsuit said. The nonrenewal “will result in damage to Herring exceeding $1 billion” if it isn’t reversed, the lawsuit said. The complaint was filed in California Superior Court in San Diego County and seeks both injunctive relief and financial damages.

Enlarge / Florida Gov. Ron DeSantis speaks during a press conference before newly appointed state Surgeon General Dr. Joseph Ladapo at Neo City Academy in Kissimmee, Florida. (credit: Getty | SOPA images)

Florida is allowing its top public health official in Orlando to return to work after a two-month suspension related to an email he sent to his staff noting their abysmal COVID-19 vaccination rate and urging them to get vaccinated.

Dr. Raul Pino, the health administrator for Florida’s Orange County, sent the email to public health employees on January 4 as the state was seeing a surge of COVID-19 cases amid the omicron wave of the pandemic. The email noted that less than half of the 568 employees at the county’s public health office were fully vaccinated against COVID-19. Only 77 of them had gotten a booster shot, Pino added. He called the staff’s vaccination rate “pathetic” and wrote that it was “irresponsible” not to be vaccinated at that point.

“I have a hard time understanding how we can be in public health and not practice it,” he wrote, according to Click Orlando.