Posts Tagged


Google suspends Chrome upgrades as COVID-19 impacts software schedules

Google has stopped upgrading its Chrome browser and its Chrome OS operating system because of the COVID-19 pandemic and has not said when it would resume refreshing either.

“Due to adjusted work schedules at this time, we are pausing upcoming Chrome and Chrome OS releases,” Google said in a short statement posted Wednesday to its Chrome releases blog. “Our primary objectives are to ensure they continue to be stable, secure, and work reliably for anyone who depends on them. We’ll continue to prioritize any updates related to security, which will be included in Chrome 80.”

The “adjusted work schedule” clearly referred to the disruption caused by the pandemic, including a six-county “shelter-in-place” order for California’s Bay Area. Google’s headquarters in Mountain View, Calif., 39 miles southwest of San Francisco, is located in Santa Clara County, one of the six under lockdown.

On March 10, Google recommended that all North American employees work from home.

According to a now-outdated Chrome release schedule, Google was supposed to upgrade the browser to version 81 on Tuesday, March 17. Chrome OS was to shift to version 81 on March 24. Google had both on a metronomic schedule that delivered new features every six to eight weeks.

Also on Wednesday, Google updated Chrome 80 — the version that debuted Feb. 4 — to build 80.0.3987.149, which contained fixes for 13 security vulnerabilities. The nine that Google called out in a separate post were all rated as “High,” the second-most-serious threat ranking in a four-step scoring system. Only one of the nine noted a bug bounty amount — $8,500 — and five other bug listings said that a cash reward would be determined later.

Four of the nine described vulnerabilities were reported to Google by Yue Mo of the San Francisco-based Semmle Security Research Team. Three of the remainder were discovered by members of Google’s own Project Zero group.

Google did not offer a timetable for resuming Chrome and Chrome OS upgrades. The next in the two product series were slated to release April 28 (Chrome) and May 5 (Chrome OS).

It was unclear if the Chromium project had also paused, although code commits were still landing Wednesday. If the Google-led, open-source Chromium did halt new work, then Chrome (and the other browsers that rely on Chromium) would not be able to progress in any case. Microsoft, which in January released a revamped Edge built atop Chromium, may have to follow Google’s lead and limit its browser to security updates, too.

Copyright © 2020 IDG Communications, Inc.

Source link

How Media File Jacking Impacts WhatsApp and Telegram on Android

People use secure messaging services with end-to-end encryption like WhatsApp or Telegram because they believe they will keep their messages and devices more secure. While this is generally true, there are security issues with these apps that users need to be aware of.

Recently, an exploit called media file jacking has been revealed on Android devices running WhatsApp and Telegram. If you use either of these apps, there are steps you need to take to protect yourself and your device.

How Are Media Files a Security Risk?

Telegram - Media File Jacking

The security firm Symantec announced the vulnerability, which can be used to spread fake news or trick users into sending payments to the wrong address. It works through the system which allows messaging apps to receive media files, such as when a friend sends you a photo or video using an app.

In order to receive the file, your Android device needs to have what is called write to external storage permissions. This means that the app can take a file which is sent to you and save it onto your device’s SD card.

Ideally, apps like Telegram or WhatsApp would only have permission to write to internal storage. That means the files can be viewed within the app but cannot be accessed by other apps. But that would mean that if someone sends you a photo, you can’t automatically see it in your camera gallery.

WhatsApp saves files to external storage by default. Telegram saves files to the SD card if the “Save to gallery” option is enabled.

What Is Media File Jacking?

The attack works by intercepting the process by which a messaging app saves media files.

First, a user downloads an innocent-seeming app such as a free game, but there is actually malware hidden inside which runs in the background of their device.

Now, the user goes to their messaging app. If the app saves media files to external storage, the malicious app can target the files at the moment between the time at which they are saved to the hard drive and the time at which they are displayed in the app.

Media File Jacking diagram
Image Credit: Symantec

This is similar to a man-in-the-middle attack

What Is a Man-in-the-Middle Attack? Security Jargon Explained

What Is a Man-in-the-Middle Attack? Security Jargon Explained

If you’ve heard of “man-in-the-middle” attacks but aren’t quite sure what that means, this is the article for you.
Read More

. The malicious app monitors your device for any changes to the external storage and steps in the moment it detects a change. Once a real file is saved to your device from your messaging app, the malicious app steps in and overwrites that file with its own file. Then the fake file is displayed in your messaging app.

This works for images and audio files. It even swaps out the thumbnail in the messaging app, so users have no idea the file they are opening is not the file their contact sent to them.

What Kind of Information Could Be Manipulated?

An example of how this could be misused is a vendor who uses WhatsApp or Telegram to send an invoice to a client. If the client’s device has malware, it could swap out the real invoice for a fake one. The fake invoice has the scammer’s bank details instead of the vendor’s bank details.

The client would then pay the sum of the invoice to the scammer. They would never be aware that they were being tricked. As far as the client would be aware, they would see a regular invoice from their vendor and have no reason not to trust it.

Other personal and business documents could be at risk too. The exploit could manipulate personal photos or videos, voice memos, or business documents. This could be something small like swapping out photos sent through apps for inappropriate images. Or it could be something more sophisticated like a business executive who saves a voice memo to their phone and sends it to a secretary for transcription.

The voice memo could be changed to say anything the attackers want, causing chaos.

This situation is particularly worrying because people have come to trust that messages they send using services with end-to-end encryption are secure. Many people know that SMS messages or emails can be faked

What Is Email Spoofing? How Scammers Forge Fake Emails

What Is Email Spoofing? How Scammers Forge Fake Emails

It looks like your email account has been hacked, but those weird messages you didn’t send are actually due to email spoofing.
Read More

. So they are on the lookout for a scam even if a message appears to be from someone they know. But people trust in encrypted messaging. They aren’t so aware of the potential security threat that could be posed by these apps.

How Can Media File Jacking Spread Fake News?

One unexpected problem that this attack could cause is spreading fake news. Many people use a Telegram feature called channels. Channels are forums through which an admin can send messages to a large group of subscribers. Some people use this as a news feed, viewing daily news stories from a trusted channel within their Telegram app.

The concern is that media file jacking could be used to interfere with news channels. A trusted news channel admin sends out a news-worthy image. Then that image is intercepted by a malicious app on the receiver’s phone. The real image is swapped for a fake news image. The admin would have no idea this had happened and the recipient would think that the image was a real news story.

How to Protect Your Devices From Media File Jacking

A true fix for this vulnerability will require developers to rethink the way they approach saving files to storage in Android. However, there is a quick fix for users in the meantime. You simply need to disable saving files to external storage.

To do this on Telegram, open the menu by swiping from the left of the app and go to Settings. Then go to Chat Settings. Make sure the Save to Gallery toggle is set to off.

To disable external file storage on WhatsApp, go to Settings, then to Chats. Make sure the Media Visibility toggle is set to off.

Once you have changed this setting, your messaging app will be protected against media file jacking attacks.

Update WhatsApp and Telegram Settings to Avoid Media Jacking

Media file jacking is an example of the clever ways in which attackers can interfere with your device through a messaging app. It’s a good idea to change your settings to make sure your device isn’t vulnerable.

While you’re learning about security and messaging apps, check out the WhatsApp security threats users need to know about

Is WhatsApp Safe? 5 Security Threats Users Need to Know About

Is WhatsApp Safe? 5 Security Threats Users Need to Know About

WhatsApp security is a challenge. It’s a favorite target of scammers and hackers. Is WhatsApp safe? Here’s what you need to know.
Read More


Source link

How Color Impacts UX | Webdesigner Depot

Color impacts everything from how a user feels when they interact with a design, to how they use the design, to whether they can fully see and understand it. Quite simply, color is a lot more than a decorative tool; color is central to user experience.

Let’s start with a common example: You’ve just finished a website design for someone. It looks and functions exactly like the wireframe. Everyone on the design team has praised the project. The client hates it, but they can’t explain why.

Create your own professional website with Wix dot com.
Create your own professional website with

The culprit might be color. Different colors can evoke such strong emotions that people have sharp reactions to them. It’s part personal preference, part psychological, and even part social norms. Understanding these tendencies and user preferences can greatly impact user experience.

Here’s what you need to know.


User Expectations and Preferences

User experience starts with the type of user your website or app is designed for. Basic demographics such as gender or region where a user lives can impact their perception of your design based on color. (You can read more about color and cultural considerations here.)

One of the most interesting impacts from color on UX is linked to gender. Studies have shown that men and women tend to like and dislike certain types of color.


Men tend to interact more with websites that have darker design schemes and more saturated colors, such as the design for VLNC Studio, above.

Women tend to prefer to interact with websites that have lighter design schemes and more muted color palettes, such as Tally, below.

Some men have a sharp reaction to websites using distinctly feminine colors such as pastel pinks, purples, and yellows.

More women tend to be put off by websites with harsh color schemes such as dark background with fully saturated red accents.

Mid-tone palettes are the most generally appealing to everyone.



Color Associations and Meanings

While it’s not an exact science, colors have fairly distinct emotional associations. Note that some colors can fall into categories of extremes. These associations tend to work with other design elements to create an overall vibe.

When a user sees a certain color or combination of colors, it creates an immediate response in the brain.

  • Red: Power, danger, love/passion, hunger
  • Yellow: Energy, happiness, light, warmth
  • Orange: Creativity, determination, stimulation, encouragement
  • Green: Nature, growth, harmony, freshness
  • Blue: Confidence, trust, serenity, calmness
  • Purple: Magic, royalty, ambition, independence


Establishing Brand Recognition


You expect design elements for Coca-Cola to be red. The color is so synonymous with the brand that it’s referred to as “Coke red.” Change the color and the brand is confusing. You don’t recognize it right away. The user is jarred and doesn’t quite react in the expected fashion. The drink might even seem to taste different.

All of those feelings come from changing the color. You might have felt yourself say “what?” when you saw the first image with green Coca-Cola branding.


It impacted the user experience you would have with the brand moving forward.

Color is an important element in branding because it creates that distinct connected between a user and a design. Color tells users what the brand is about. It tells users about the thing they are about to engage with.

Change that color, or use something off brand, and the user experience suffers because website visitors are suddenly confused or uncertain about the brand they thought they knew.


User Patterns Connect to Color

Have you noticed how many websites use red or orange buttons?

There’s a reason for that.

Bright colored buttons that contrast with the background of a website – red and orange often stand out from either light or dark backgrounds. Can help users find, understand, and want to engage with click- or tappable elements because they visually, and immediately, know what their expectation of that element is.

A key part of user experience is providing easy opportunities for users to interact that they enjoy and understand.


Cruise uses a ghost-style button with red text and a red hover state. It’s a different spin on traditional solid-color buttons, but there’s little question as to how to interact with it. Color draws users to the button.


Net Bluez uses a bright orange button for the most important element in the navigation menu. Notice how that element tends to jump off the screen begging to be clicked.


Increasing Conversion Rates

Challenge yourself in the design process to A/B Test button color. You’ll likely find that one color has a distinctly higher conversion rate than the other. (And it might not be the color you expect.)

Conversion rates tend to increase when the color of buttons or links is in stark contrast to the rest of the design. So, while you want to use a brand palette, picking a contrast color is key to generating conversions that contribute to overall user experience.

Look at the website below for a minute. Which color button is most likely to make you click? (The original color is blue.)



Providing Accessibility to All Users

Finally, color impacts UX in a way that’s not emotional or rooted in psychology. It’s much more practical than that.

Color impacts user experience because it can make a design accessible or not.

In order for everyone to understand a design fully, and engage with content, they must be able to see and read it with ease. Using color palettes and contrast ratios that fall in line with Web Content Accessibility Guidelines (WCAG 2.1) can ensure that every user can understand your color choices.

Use a color-blind filter, such as those in the comparisons below, to help simulate what other users might see when they look at your website. How could that impact usability?




Think of color as a tool to help users better interact and experience the content on your website. It impacts user experience on an emotional and usability level.

The key to figuring out if color is impacting UX in the right way is through user testing. A/B color tests can be a valuable tool.

Source link