67.4 F
Monday, June 17, 2019


Home Tech

Canada Uses Civil Anti-Spam Law in Bid to Fine Malware Purveyors


Canadian government regulators are using the country’s powerful new anti-spam law to pursue hefty fines of up to a million dollars against Canadian citizens suspected of helping to spread malicious software.

Canada Uses Civil Anti-Spam Law in Bid to Fine Malware Purveyors 1

In March 2019, the Canadian Radio-television and Telecommunications Commission (CRTC) — Canada’s equivalent of the U.S. Federal Communications Commission (FCC), executed a search warrant in tandem with the Royal Canadian Mounted Police (RCMP) at the home of a Toronto software developer behind the Orcus RAT, a product that’s been marketed on underground forums and used in countless malware attacks since its creation in 2015.

The CRTC was flexing relatively new administrative muscles gained from the passage of Canada’s Anti-Spam Legislation (CASL), which covers far more than just junk email. Section 7 of CASL deals with the alteration of transmission data, including botnet activity. Section 8 involves the surreptitious installation of computer programs on computers or networks including malware and spyware.

And Section 9 prohibits an individual or organization from aiding, inducing, procuring or causing to be procured the doing of any of the above acts.

CRTC Director Neil Barratt said this allows his agency to target intermediaries who, through their actions or through inaction, facilitate the commission of CASL violations. Businesses found to be in violation of CASL can be fined up to $10 million; individuals can face up to a $1 million fine.

“We’re dealing with a lower burden of proof than a criminal conviction, and CASL gives us a little more leeway to get bad actors off our networks in Canada and to ultimately improve security for people here and hopefully elsewhere,” Barratt said in an interview with KrebsOnSecurity.

“CASL defines spam as commercial electronic messages without consent or the installation of software without consent or the intercepting of electronic messages,” Barratt said. “The installation of software is under Section 8, and this is one of the first major investigations under that statute.”

Barratt added that the CRTC also was counting on CASL to help tidy up the reputation of the Canadian Web hosting industry.

“We’ve been trying to make sure that service providers operating in Canada — whether or not they are Canadian — are not unduly contributing to the infection of machines and hosting malware,” Barratt said. “We have great power in CASL and Section 9 makes it a violation to aid in the doing of a violation. And this extends quite broadly, across email service providers and various intermediaries.”

The enforcement division of the CRTC recently took action against two companies — Datablocks Inc. and Sunlight Media Network Inc — for having violated CASL section 9 by disseminating online ads that caused malicious computer programs to be downloaded onto the computers of unsuspecting victims.

Under CASL, and for the purposes of verifying compliance or determining whether any of sections 6 to 9 were violated, the CRTC may compel individuals and organizations to provide any information in their possession or control, and ask a justice of the peace to issue a warrant authorizing entry into a place of residence.

It’s good to see a civil anti-spam law being used to go after people involved in selling malware couched as legitimate software, as seems to be the case with the Orcus RAT investigation. A relatively competent remote access trojan author can earn a tidy income selling their wares, but CASL may give Canadians interested in this line of a work a reason to reconsider if the end result is a million dollar fine.

More to the point, Canada (anecdotally at least) seems to have far more than its fair share of computer criminals, and yet unfortunately far less appetite than many other western countries for prosecuting those individuals criminally. In this regard, CASL offers a welcome alternative.

“One of the key takeaways of CASL was that it wasn’t just about emails that were annoying people, but also the use of email as a vector to mislead or defraud people and cause harm to computers and computer networks,” Barratt said. “Our parliamentarians decided to ensure the legislature covered a broad ambit. The search warrant executed in this case was a great example of criminal and civil law enforcement working together by using our unique tools and powers under the act to achieve the greatest good we could.”

Canada Uses Civil Anti-Spam Law in Bid to Fine Malware Purveyors 2

Tags: Canada’s Anti-Spam Legislation, CASL, Neil Barratt

You can skip to the end and leave a comment. Pinging is currently not allowed.

NY Investigates Exposure of 885 Million Mortgage Documents


New York regulators are investigating a weakness that exposed 885 million mortgage records at First American Financial Corp. [NYSE:FAF] as the first test of the state’s strict new cybersecurity regulation. That measure, which went into effect in March 2019 and is considered among the toughest in the nation, requires financial companies to regularly audit and report on how they protect sensitive data, and provides for fines in cases where violations were reckless or willful.

On May 24, KrebsOnSecurity broke the news that First American had just fixed a weakness in its Web site that exposed approximately 885 million documents — many of them with Social Security and bank account numbers — going back at least 16 years. No authentication was needed to access the digitized records.

On May 29, The New York Times reported that the inquiry by New York’s Department of Financial Services is likely to be followed by other investigations from regulators and law enforcement.

First American says it has hired a third-party security firm to investigate, and that it shut down external access to the records.

The Times says few people outside the real estate industry are familiar with First American, but millions have entrusted their data to the company when they go to close the deal on buying or selling a new home.

“First American provides title insurance and settlement services for property sales, which typically require buyers to hand over extensive financial records to other parties in their transactions,” wrote Stacy Cowley. “The company is one of the largest insurers in the United States, handling around one in every four transactions, according to the American Land Title Association.”

News also emerged this week that First American is now the target of a class action lawsuit alleging the Fortune 500 mortgage industry giant “failed to implement even rudimentary security measures.”

NY Investigates Exposure of 885 Million Mortgage Documents 3

Tags: First American Financial Corp., New York Department of Financial Services, New York Times, Stacy Cowley

You can skip to the end and leave a comment. Pinging is currently not allowed.

Report: No ‘Eternal Blue’ Exploit Found in Baltimore City Ransomware


For almost the past month, key computer systems serving the government of Baltimore, Md. have been held hostage by a ransomware strain known as “Robbinhood.” Media publications have cited sources saying the Robbinhood version that hit Baltimore city computers was powered by “Eternal Blue,” a hacking tool developed by the U.S. National Security Agency (NSA) and leaked online in 2017. But new analysis suggests that while Eternal Blue could have been used to spread the infection, the Robbinhood malware itself contains no traces of it.

On May 25, The New York Times cited unnamed security experts briefed on the attack who blamed the ransomware’s spread on the Eternal Blue exploit, which was linked to the global WannaCry ransomware outbreak in May 2017.

That story prompted a denial from the NSA that Eternal Blue was somehow used in the Baltimore attack. It also moved Baltimore City Council President Brandon Scott to write the Maryland governor asking for federal disaster assistance and reimbursement as a result.

But according to Joe Stewart, a seasoned malware analyst now consulting with security firm Armor, the malicious software used in the Baltimore attack does not contain any Eternal Blue exploit code. Stewart said he obtained a sample of the malware that he was able to confirm was connected to the Baltimore incident.

“We took a look at it and found a pretty vanilla ransomware binary,” Stewart said. “It doesn’t even have any means of spreading across networks on its own.”

Stewart said while it’s still possible that the Eternal Blue exploit was somehow used to propagate the Robbinhood ransomware, it’s not terribly likely. Stewart said in a typical breach that leads to a ransomware outbreak, the intruders will attempt to leverage a single infection and use it as a jumping-off point to compromise critical systems on the breached network that would allow the malware to be installed on a large number of systems simultaneously.

“It certainly wouldn’t be the go-to exploit if your objective was to identify critical systems and then only when you’re ready launch the attack so you can do it all at once,” Stewart said. “At this point, Eternal Blue is probably going to be detected by internal [security] systems, or the target might already be patched for it.”

It is not known who is behind the Baltimore ransomware attack, but Armor said it was confident that the bad actor(s) in this case were the same individual(s) using the now-suspended twitter account @Robihkjn (Robbinhood). Until it was suspended at around 3:00 p.m. ET today (June 3), the @Robihkjn account had been taunting the mayor of Baltimore and city council members, who have refused to pay the ransom demand of 13 bitcoin — approximately $100,000.

In several of those tweets, the Twitter account could be seen posting links to documents allegedly stolen from Baltimore city government systems, ostensibly to both prove that those behind the Twitter account were responsible for the attack, and possibly to suggest what may happen to more of those documents if the city refuses to pay up by the payment deadline set by the extortionists — currently June 7, 2019 (the attackers postponed that deadline once already).

Report: No ‘Eternal Blue’ Exploit Found in Baltimore City Ransomware 4

Some of @robihkjn’s tweets taunting Baltimore city leaders over non-payment of the $100,000 ransomware demand. The tweets included links to images of documents allegedly stolen by the intruders.

Over the past few days, however, the tweets from @Robinhkjn have grown more frequent and profanity-laced, directed at Baltimore’s leaders. The account also began tagging dozens of reporters and news organizations on Twitter.

Stewart said the @Robinhkjn Twitter account may be part of an ongoing campaign by the attackers to promote their own Robbinhood ransomware-as-a-service offering. According to Armor’s analysis, Robbinhood comes with multiple HTML templates that can be used to substitute different variables of the ransom demand, such as the ransom amount and the .onion address that victims can use to negotiate with the extortionists or pay a ransom demand.

“We’ve come to the conclusion Robbinhood was set up to be a multi-tenant ransomware-as-a-service offering,” Stewart said. “And we’re wondering if maybe this is all an effort to raise the name recognition of the malware so the authors can then go on the Dark Web and advertise it.”

Report: No ‘Eternal Blue’ Exploit Found in Baltimore City Ransomware 5

This redacted message is present on the Dark Web panel set up by the extortionists to accept payment for the Baltimore ransomware incident and to field inquiries or pleas from them. The message repeats the last tweet from the @robihkjn Twitter account and conclusively ties that account to the attackers. Image: Armor.

There was one other potential — albeit likely intentional — clue that Stewart said he found in his analysis of the malware: Its code included the text string “Valery.” While this detail by itself is not particularly interesting, Stewart said an earlier version of the GandCrab ransomware strain would place a photo of a Russian man named Valery Sinyaev in every existing folder where it would encrypt files. PCRisk.com, the company that blogged about this connection to the GandCrab variant, asserts Mr. Sinyaev is a respectable finance professional who has nothing to do with GandCrab.

The timing of the GandCrab connection is notable because just last week, the creators of GandCrab announced they were shutting down their ransomware-as-a-service product, allegedly after earning more than $2 billion in ransom payments.

Finally, since we’re on the subject of major ransomware attacks and scary exploits, it’s a good time to remind readers about the importance of applying the latest security updates from Microsoft, which last month took the unusual step of releasing security updates for unsupported but still widely-used Windows operating systems like XP and Windows 2003. Microsoft did this to head off another WannaCry-like outbreak from mass-exploitation of a newly discovered flaw that Redmond called imminently “wormable.”

That vulnerability exists in Windows XP, Windows 2003, Windows 7, Windows Server 2008 R2, and Windows Server 2008. In a reminder about the urgency of patching this bug, Microsoft on May 30 published a post saying while it hasn’t seen any widespread exploitation of the flaw yet, it took about two months after Microsoft released a fix for the Eternal Blue exploit in March 2017 for WannaCry to surface.

“Almost two months passed between the release of fixes for the EternalBlue vulnerability and when ransomware attacks began,” Microsoft warned. “Despite having nearly 60 days to patch their systems, many customers had not. A significant number of these customers were infected by the ransomware.”

Report: No ‘Eternal Blue’ Exploit Found in Baltimore City Ransomware 6

Tags: Armor, Eternal Blue, GandCrab, Joe Stewart, Microsoft Windows, national security agency, PCRisk.com, Robbinhood ransomware, robinhkjn, The New York Times, twitter, Valery

You can skip to the end and leave a comment. Pinging is currently not allowed.

LabCorp: 7.7 Million Consumers Hit in Collections Firm Breach


Medical testing giant LabCorp. said today personal and financial data on some 7.7 million consumers were exposed by a breach at a third-party billing collections firm. That third party — the American Medical Collection Agency (AMCA) — also recently notified competing firm Quest Diagnostics that an intrusion in its payments Web site exposed personal, financial and medical data on nearly 12 million Quest patients.

LabCorp: 7.7 Million Consumers Hit in Collections Firm Breach 7Just a few days ago, the news was all about how Quest had suffered a major breach. But today’s disclosure by LabCorp. suggests we are nowhere near done hearing about other companies with millions of consumers victimized because of this incident: The AMCA is a New York company with a storied history of aggressively collecting debt for a broad range of businesses, including medical labs and hospitals, direct marketers, telecom companies, and state and local traffic/toll agencies.

In a filing today with the U.S. Securities and Exchange Commission, LabCorp. said it learned that the breach at AMCA persisted between Aug. 1, 2018 and March 30, 2019. It said the information exposed could include first and last name, date of birth, address, phone, date of service, provider, and balance information.

“AMCA’s affected system also included credit card or bank account information that was provided by the consumer to AMCA (for those who sought to pay their balance),” the filing reads. “LabCorp provided no ordered test, laboratory results, or diagnostic information to AMCA. AMCA has advised LabCorp that Social Security Numbers and insurance identification information are not stored or maintained for LabCorp consumers.”

LabCorp further said the AMCA has informed LabCorp “it is in the process of sending notices to approximately 200,000 LabCorp consumers whose credit card or bank account information may have been accessed. AMCA has not yet provided LabCorp a list of the affected LabCorp consumers or more specific information about them.”

The LabCorp disclosure comes just days after competing lab testing firm Quest Diagnostics disclosed that the hack of AMCA exposed the personal, financial and medical data on approximately 11.9 million patients.

Quest said it first heard from the AMCA about the breach on May 14, but that it wasn’t until two weeks later that AMCA disclosed the number of patients affected and what information was accessed, which includes financial information (e.g., credit card numbers and bank account information), medical information and Social Security Numbers.

Quest says it has since stopped doing business with the AMCA and has hired a security firm to investigate the incident. Much like LabCorp, Quest also alleges the AMCA still hasn’t said which 11.9 million patients were impacted and that the company was withholding information about the incident.

The AMCA declined to answer any questions about whether the breach of its payment’s page impacted anyone who entered payment data into the company’s site during the breach. But through an outside PR firm, it issued the following statement:

“We are investigating a data incident involving an unauthorized user accessing the American Medical Collection Agency system,” reads a written statement attributed to the AMCA. “Upon receiving information from a security compliance firm that works with credit card companies of a possible security compromise, we conducted an internal review, and then took down our web payments page.”

The statement continues:

“We hired a third-party external forensics firm to investigate any potential security breach in our systems, migrated our web payments portal services to a third-party vendor, and retained additional experts to advise on, and implement, steps to increase our systems’ security. We have also advised law enforcement of this incident. We remain committed to our system’s security, data privacy, and the protection of personal information.”


The AMCA also does business under the name “Retrieval-Masters Credit Bureau,” a company that has been in business since 1977. Retrieval-Masters also has an atrocious reputation for allegedly harassing consumers for debts they never owed.

A search on the company’s name at the complaints page of the Consumer Financial Protection Bureau (CFPB) turns up almost 700 complaints for Retrieval-Masters. The company has an abysmal “F” rating from the Better Business Bureau, with 60 complaints closed against it in the last three years.

Reviewing a number of those complaints reveals some of the AMCA’s other current and/or previous clients, including New Jersey’s EZPass system. Recent consumer complaints about the AMCA also invoke the name of American Traffic Solutions, which services rental car fleets and processes some 50 million toll transactions per year. ATS did not respond to requests for comment.

My guess is we will soon hear about many other companies and millions more consumers impacted by this breach at the AMCA. Certainly, companies like Quest and LabCorp. have a duty to ensure contractors are properly safeguarding their patients’ personal, medical and financial information.

But this AMCA incident is the latest example of a breach at a little-known company that nevertheless holds vast quantities of sensitive data that was being shared or stored in ways that were beyond the control of affected consumers.

On May 24, KrebsOnSecurity broke the news that the Web site for Fortune 500 real estate title insurance giant First American Financial [NYSE:FAF] leaked 885 million documents related to mortgage deals going back to 2003, until notified by KrebsOnSecurity. The digitized records — including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images — were available without authentication to anyone with a Web browser.

Many readers wrote in to say they’d never heard of First American, but it is the largest title insurance company in the United States. Title insurance is generally required for all home mortgages, and it protects the buyer from any previously unknown claims against the property. First American currently handles about one in every four title insurance transactions — usually as part of the mortgage closing process — which means tens of millions of Americans were potentially exposed by the company’s inexplicably lax security.

LabCorp: 7.7 Million Consumers Hit in Collections Firm Breach 8

Tags: American Medical Collection Agency, American Traffic Solutions, Consumer Financial Protection Bureau, EZPass, LabCorp, Quest Diagnostics breach, Retrieval-Masters Credit Burea

You can skip to the end and leave a comment. Pinging is currently not allowed.

Microsoft Patch Tuesday, June 2019 Edition


Microsoft on Tuesday released updates to fix 88 security vulnerabilities in its Windows operating systems and related software. The most dangerous of these include four flaws for which there is already exploit code available. There’s also a scary bug affecting all versions of Microsoft Office that can be triggered by a malicious link or attachment. And of course Adobe has its customary monthly security update for Flash Player.

Microsoft Patch Tuesday, June 2019 Edition 9Microsoft says it has so far seen no exploitation against any of the four flaws that were disclosed publicly prior to their patching this week — nor against any of the 88 bugs quashed in this month’s release. All four are privilege escalation flaws: CVE-2019-1064 and CVE-2019-1069 affect Windows 10 and later; CVE-2019-1053 and CVE-2019-0973 both affect all currently supported versions of Windows.

Most of the critical vulnerabilities — those that can be exploited by malware or miscreants to infect systems without any action on the part of the user — are present in Microsoft’s browsers Internet Explorer and Edge.

According to Allan Liska, senior solutions architect at Recorded Future, serious vulnerabilities in this month’s patch batch reside in Microsoft Word (CVE-2019-1034 and CVE-2019-1035).

“This is another memory corruption vulnerability that requires an attacker to send a specially crafted Microsoft Word document for a victim to open, alternatively an attacker could convince a victim to click on a link to a website hosting a malicious Microsoft Word document,” Liska wrote. “This vulnerability affects all versions of Microsoft Word on Windows and Mac as well as Office 365. Given that Microsoft Word Documents are a favorite exploitation tool of cybercriminals, if this vulnerability is reverse engineered it could be widely exploited.”

Microsoft also pushed an update to plug a single critical security hole in Adobe’s Flash Player software, which is waning in use but it still is a target for malware purveyors. Google Chrome auto-updates Flash but also is now making users explicitly enable Flash every time they want to use it. By the summer of 2019 Google will make Chrome users go into their settings to enable it every time they want to run it.

Firefox also forces users with the Flash add-on installed to click in order to play Flash content; instructions for disabling or removing Flash from Firefox are here. Adobe will stop supporting Flash at the end of 2020.

Note that Windows 10 likes to install patches all in one go and reboot your computer on its own schedule. Microsoft doesn’t make it easy for Windows 10 users to change this setting, but it is possible. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in Windows Update. To get there, click the Windows key on your keyboard and type “windows update” into the box that pops up.

Staying up-to-date on Windows patches is good. Updating only after you’ve backed up your important data and files is even better. A good backup means you’re not pulling your hair out if the odd buggy patch causes problems booting the system. So do yourself a favor and backup your files before installing any patches.

As always, if you experience any problems installing any of the patches this month, please feel free to leave a comment about it below; there’s a good chance other readers have experienced the same and may even chime in here with some helpful tips.

Additional reading:

Martin Brinkmann’s take at Ghacks.net

Qualys on Patch Tuesday

SANS’s quick reference by severity

Microsoft Patch Tuesday, June 2019 Edition 10

Tags: Allan Liska, CVE-2019-0973, CVE-2019-1034, CVE-2019-1035, CVE-2019-1053, CVE-2019-1064, CVE-2019-1069, Patch Tuesday June 2019, Recorded Future

You can skip to the end and leave a comment. Pinging is currently not allowed.

ThinkGeek.com to close, replaced as a section of GameStop


Sad news for anyone who loves geeky goods and top-notch April Fools’ jokes: ThinkGeek.com, the 20-year-old online retailer known for selling more geek-centric gadgets and peripherals than you could fit in a TARDIS, is going away.

According to an FAQ sitting at the top of its site, ThinkGeek isn’t “shutting down,” it just won’t continue on as the site we’ve come to know, instead living on as a shadow of its former self as a section in GameStop (which acquired ThinkGeek in 2015 for a reported $140 million.)

Says the FAQ:

On July 2nd, 2019, ThinkGeek.com will be moving in with our parent company GameStop. After this move, you will be able to shop a curated selection of unique items historically found on ThinkGeek.com via a ThinkGeek section at GameStop

The word “curated” is pretty key, there, because there’s just no way a couple of shelves in GameStop will be able to cover the array of fandoms that ThinkGeek.com covered. From Marvel, to Star Wars, to Potter, to Tolkien, it covered a whole lot of (fan)bases in one swoop.

ThinkGeek.com is — or, I guess, was — one of those shops that was fun to explore; anytime I found myself there, I’d inevitably lose track of time clicking around from category to category, often throwing down a credit card for some Star Wars shirt or Aperture Science pint glass I probably didn’t need. Hopefully that sense of “Oooh, look at that! And that! And that!” will live on in whatever section springs up on GameStop’s site.

The company also says that the 40 standalone ThinkGeek retail stores dotting the U.S. will stay open.

This news comes after a few back-to-back 75%-off sales of all clearance goods, and now it looks like they’ve marked things down 50% site-wide to clear the warehouses.

Perhaps most of all, we’ll miss ThinkGeek’s April Fools’ day gags. On a day in which many companies find themselves trying a bit too hard to make us laugh, ThinkGeek just always seemed to get it right. They’d sprinkle their site with fake product listings for people to stumble upon. Things like…

The Fortnite R/C Battle Bus:

ThinkGeek.com to close, replaced as a section of GameStop 11

Or the Admiral Ackbar Singing Bass:

ThinkGeek.com to close, replaced as a section of GameStop 12

Or the absolutely brilliant Tauntaun sleeping bag (a gag that proved so popular that they ended up making and selling them for a while):

ThinkGeek.com to close, replaced as a section of GameStop 13


ThinkGeek says it’ll still take return requests for orders made before June 13th, and that any ThinkGeek gift cards you’ve got sitting around will be honored at GameStop’s online and real-world locations.

Pixel 4 Rumors: Release Date, Features, Design and More


The Pixel 3 was our favorite Android smartphone to come out last year, thanks to its clever software, class-leading camera and understated design. That has us plenty excited to find out what Google is planning for the Pixel 4 later this year.

Credit: Shaun Lucas/Tom's GuideCredit: Shaun Lucas/Tom’s Guide

Fortunately, the rumor mill is finally starting to churn in earnest now. In the last three days, we’ve been treated to renders reportedly based on actual schematics, a pair of CNC-machined mockups of the regular and XL models for case-making purposes and rumblings about a complex front-facing camera array that will be used for iPhone-style depth-aware facial identification.

And yet, none of those tidbits are as wild as what’s making the rounds most recently: a report that the Pixel 4 will utilize an advanced radar sensor to read hand gestures in the air with incredible precision, and without you needing to touch the display. Oh, and then Google decided to just skip the leaks and give us all a photo of the back of the phone anyway.

Here’s everything we know to date about Google’s next flagship, which will certainly face stiff competition from the Galaxy S10 lineup of phones and Apple’s yet-unnamed 2019 iPhones.

Latest Pixel 4 rumors: June 2019

Pixel 4 release date

The Pixel 3 and Pixel 3 XL were unveiled on October 9, 2018 and the phones went on sale in the U.S. Oct. 18. The handsets were released elsewhere Nov. 1. If Google followed a similar timeframe for the Pixel 4, we might expect the phones to be announced Tuesday Oct. 8 and hit store shelves Oct. 17, which would be the following Thursday.

Leaker Evan Blass tweeted out an image of what’s reportedly Verizon marketing material which lists launch dates for major smartphones for the rest of the year. While the focus is on the iPhone 11’s late-September launch, there’s a listing for the Pixel 4 around the middle of October.


Well that was fast. Mere days after a new render of the Pixel 4 emerged, which included a prominent, rectangular camera bump on the back (much like the one the iPhone XS successor has been rumored to have), Google went out and confirmed the design on its Made by Google Twitter page.

Credit: GoogleCredit: Google

While Google’s given us a good look at the rear of the phone, the front is still shrouded in mystery. The possibility of a secure Face ID-style system for biometric authentication may explain the lack of a fingerprint sensor on the back, though Google could also elect to embed an optical or ultrasonic scanner beneath the display. Either way, receiving an official design confirmation likely four months before the handset’s eventual launch is unprecedented; perhaps Mountain View was spooked by last year’s debacle?

Advanced gesture features

So far, most of the rumors surrounding the Pixel 4 to date have dealt with the device’s design. But Google may also be looking to seriously revolutionize smartphone interaction, thanks to its Project Soli initiative.

Introduced at Google I/O 2015 and developed by Google’s Advanced Technology and Products division, Soli incorporates a new-fangled radar sensor that can interpret motion at a distance with incredible precision, such that you’ll be able to make gestures in the air — like turning an imaginary knob, for example to raise the volume of music — and the device will respond appropriately in real time.

Soli was first linked to the Pixel 4 by a pair of reports from 9to5Google and XDA Developers. The report from the former simply states that the website has heard the technology will debut in the Pixel 4, but doesn’t name sources. However, XDA has uncovered code within the Android Q beta that refers to a new feature labeled “Aware,” mentioned in tandem with specific gestures, like “Skip” and “Silence.” Essentially, this suggests that Aware could be the blanket name Google will use for Soli-related functionality. 

If Google can really pull off Soli in a reliable way, it’ll be a breakthrough for technological interaction. LG tried to achieve a similar goal through the use of a time-of-flight sensor in the G8 ThinQ, though the results were inconsistent, and the phone was often unable to read gestures unless the user was extremely precise in the placement and visibility of their hand in relation to the front-facing camera. Radar may allow Google to get around that limitation, but of course we won’t know for sure until we get to test the feature in the flesh — if it even sees the light of day to begin with.

Android Q

The developer beta of Google’s Android Q software packs a lot of improvements, including better control over how you share your location, an estimate of remaining battery life, contextually aware settings menus and a faster-performing sharing sheet. Google is also seriously rethinking navigation for the second year in a row, with a new gesture-based system that more closely emulates Apple’s philosophy starting with the iPhone X.

Other highlights of Android Q include easier sharing of Wi-Fi passwords and camera enhancements. Plus, call screening has been improved. The Pixel 4 is all but certain to run Android Q out of the box, while the update will arrive for all previous Pixel handsets, including the just-released midrange Pixel 3a and even the first generation Pixel, late this summer or early in the fall.

What we want to see

Of course, we expect the next-generation Pixel to implement Qualcomm’s premium system-on-chip, the Snapdragon 855, as well as even better cameras. But such improvements are really table stakes for the Pixel 4, so we’re more interested in the ways Google could further differentiate the handset from its opposition.

One way to do that is through new forms of biometric authentication — either an in-display optical or ultrasonic fingerprint sensor, or 3D facial scanning akin to Apple’s Face ID. The Pixel 3’s existing rear-mounted fingerprint scanner works perfectly well, but it is one of the more dated aspects of the phone, and makes unlocking more difficult when the device is lying flat on a surface. Fortunately, it seems Google is planning to do something about that, if the latest rumors are any indication.

The Pixel 3 is no slouch, but as Android phone makers are continually beefing up their products with increasingly larger amounts of RAM, the Pixel 3’s 4GB of memory feels a bit pedestrian. We hope this is raised to at least 6GB with the next model, as it would provide a nice boost to multitasking and launching apps from memory. Additionally, it’s about time Google follow the lead of some other manufactures, like OnePlus, and make 128 GB of storage standard.

Credit: Shaun Lucas/Tom's GuideCredit: Shaun Lucas/Tom’s GuideDesign is a subjective thing, and the Pixel 3’s is admittedly polarizing. Personally, I like the symmetry of the smaller model and find it very simple and clean, though others contend that the bezels — and especially the massive notch on the Pixel 3 XL — make Google’s latest flagships rather ugly and dated-looking. It would be great to see the company shake that perception with a slimmer, tighter aesthetic and perhaps even more exotic surfaces beyond glossy, painted aluminum and glass.

Some manufacturers are experimenting with stainless steel, ceramic, premium polycarbonates and new finishing procedures that allow glass to emulate the textural properties of other materials. Google has already exhibited a penchant for the unusual, with the Really Blue first-generation Pixel, the penguin-like Pixel 2 XL and the blush Not Pink option for the Pixel 3, so we’re holding out for even more bold colorways and novel exterior touches.

Finally, if there’s one particular area where the Pixel 3 could really use some help, it’s in the battery life department. The 2,915-mAh power pack in the 5.5-inch model is just a bit too small to accommodate stress-free everyday use. For that reason, we’d really like to see a bigger battery closer in size to the 6.3-inch Pixel 3 XL’s 3,430-mAh unit.

Willo is a robot that wants to replace your toothbrush


If you think about it, the basic concept of a toothbrush hasn’t evolved since… forever. Sure, many people have switched to an electric toothbrush, but it remains a stick with a brush at the end.

Willo thinks that’s not good enough. The company has developed an oral care device to improve brushing with a focus on plaque. The company says that basic brushing only cleans 42% of dental plaque, while electric brushes clean 46% of dental plaque.

The startup has worked with dentists to design its product. It still sounds a bit mysterious, as the company isn’t sharing much about the product. The photo above is the only image of the product right now.

But what we do know is that the startup has raised a $7.5 million funding round led by Kleiner Perkins, with Bpifrance and Nest co-founder Matt Rogers also participating. The company was founded by Hugo de Gentile, Ilan Abehassera and Jean-Marie de Gentile, and it attended The Refiners accelerator program.

Now let’s see how it actually works, how much it costs and if people are willing to change everything about the way they brush their teeth.

AT&T cancels Samsung Galaxy Fold orders


AT&T has cancelled early orders for the Samsung Galaxy Fold.

Tom’s Guide first reported the cancellation, noting that AT&T said the Galaxy Fold would be available again to order as soon as Samsung announces a new launch date. AT&T is offering $100 in credit to those whose orders it has cancelled.

The Samsung Galaxy Fold was originally scheduled to launch on April 26. However, early reviews indicated there were issues with the phone, which Samsung initially said was the fault of reviewers. The company eventually decided to postpone the launch and get back to the drawing board.

Earlier this week, a Samsung rep told Cnet that it would announce timing on the nearly $2,000 phone “in the coming weeks.”

However, AT&T’s move here suggests that it may be a while before the Galaxy Fold resurfaces, if at all.

Samsung itself asked customers who pre-ordered to confirm that they still want the device following the review period. On May 24, Best Buy cancelled all pre-orders of the phone.

Galaxy Note 10 Rumors: Release Date, Price, Specs and More


So far, 2019 has been a big year for Samsung smartphones, with multiple Galaxy S10 phones arriving on the scene and a mid-tier Galaxy A50 about to join them. (The less said about the Galaxy Fold, the better.) But the year is far from over. Samsung is readying a big launch this summer for the Galaxy Note 10. And, based on the rumors, you can expect more than one model.

Read on through our rumor roundup and be sure to check back often to find out what Samsung could ultimately deliver when it’s time to showcase the Galaxy Note 10.

Galaxy Note 10 price and availability

According to most reports, the Galaxy Note 10 will be unveiled sometime in August and make its way to store shelves in September. That certainly fits Samsung’s recent release pattern for the Galaxy Note 8 and 9, which both appeared in August allowing the company to get the jump on the September debut of Apple’s new iPhones.

Galaxy Note 9Galaxy Note 9Considering that the Galaxy S10 Plus — arguably the best comparison to the Galaxy Note 10 — costs $999, and the Galaxy Note 9 also cost $999 at launch, there’s a good chance the device will be on a similarly pricey side. This said, a recent rumor has suggested that the price will actually be bumped up by $100 or $200, with the basic price now being more than $1,000.

Two Versions: Extra large and large

A report from Korea’s The Bell says that Samsung is working on two versions of the Galaxy Note 10. One of the phone would have a large 6.7-inch display, while another model would have a smaller 6.4-inch screen. However, the report indicates that the smaller Note 10 may be slated for release in Europe only. (ETNews, in its report on Samsung’s plans, places the screen sizes at 6.3 and 6.8 inches.)

However, a SamMobile report followed that and pointed to two model numbers Samsung have been assigned to the Galaxy Note 10. Those model numbers, SM-N970 and SM-N975, haven’t been confirmed by Samsung. However, they follow the syntax Samsung has used in the past. And if accurate, the model numbers all but point to two models.

Interestingly, SamMobile also tipped two other models — SM-N971 and SM-N976. Those won’t actually be distinct models, according to the report. Instead, they’ll be 5G versions of the 970 and 975.

So, for now, it appears Samsung will be planning one large and one extra large model and then 5G variants for each, for a total of four versions. A subsequent report from leaker Ice Universe suggests that Samsung will call the larger of the two models the Galaxy Note 10 Pro. In a follow-up tweet, Ice Universe claimed the Note 10 Pro would sport a 4,500 mAh battery, which is the same size as the power pack in the Galaxy S10 5G.

The standard Note 10 however is claimed to have a significantly smaller power source. Galaxy Club, a Dutch website, has published claims that the lower tier version of the Note 10 will only have 3,400mAh to play with. It’s a disappointingly small capacity, and a step back from the Note 9, but we can hope that Samsung’s got some other tricks up its sleeve to make sure that the overall battery life hasn’t got worse as well.

Galaxy Note 9Galaxy Note 9In terms of color choices, a source who spoke to MySmartPrice claims that there will be black, white, silver, red, and pink to choose from, with the Note 10 Pro getting a few exclusive colors of its own too. Twitter user and smartphone leaker Ice Universe has suggested that there will be a “gradient, blue and silver gradient”, which could indicate one of these special Pro-version-only colors, or be referring to the silver color from the other leak, which invites the question of what other gradients might be on offer.

Credit: PhoneArenaCredit: PhoneArenaThe battery might charge quite quickly too. Ice Universe had predicted 25-watt fast charging for the Note 10, but has now dismissed that idea. After initially stating that their new belief was that the charger was going to be more powerful than 25W, they are now suggesting the Note 10’s charger might be capable of 45W charging. This is based on a recent picture Ice Universe posted of Leonardo da Vinci and the text ‘101101’. If you’re scratching your head as to how this relates to charging speed, then keep in mind that the internal code name for the Note 10 at Samsung is ‘Da Vinci’, and that in binary, 101101 translates to 45 in base 10 (our normal counting system).

A new kind of Infinity Display

Samsung’s Infinity-O display technology, which allows for a cutout for the front facing camera within an OLED screen, debuted in earnest with the Galaxy S10. For that reason, it’s not surprising that rumors have suggested the company will utilize that same design in the Galaxy Note 10. However, what we’ve heard so far suggests the implementation could be a bit different.

Credit: Onleaks/91mobilesCredit: Onleaks/91mobilesFor one, that hole punch might be shifted over to the center. (That’s where the front camera will be on the new Galaxy A50, though that cheaper model is using Samsung’s Infinity-U display which has a teardrop-shaped cutout.) To be honest, it’s difficult to track down exactly where this rumor began — PhoneArena suggested it in a mockup, and T3 reported it alongside a new story that mentioned the Note 10 will feature a 19:9 display, based on a leaked benchmark from html5test discovered by Dutch blog Mobielkopen. It’s also been repeated by Twitter user OnLeaks, and 91 Mobiles (with whom OnLeaks helped create the above render) but he doesn’t cite a specific source.

For those keeping track, the aspect ratio of the Note 9’s panel was 18.5:9, so it appears Samsung’s next-gen phablet could carry a screen that’s a bit taller than the current iteration. As for that center-mounted selfie camera — like all rumors, take it with a grain of salt.

If you compare the latest OnLeaks renders of the Note 10 and Note 10 Pro (below), you can see the differences between the two handsets, which are in summary the size, the materials (the Pro is expected to be available with a ceramic back, like the high end S10s) and the fourth camera on the Pro.

Ice Universe passed judgement on these renders in a tweet, saying that the renders were ‘a bit exaggerated’, particularly the Pro’s chin, which they claim is only slightly smaller than that of the S10+. So take these renders with an additional pinch of salt compared to usual, as the real thing might be a little chunkier than the renderers are showing!

Credit: Onleaks/PricebabaCredit: Onleaks/PricebabaButtons or no buttons?

Samsung could have ditched the buttons in its Galaxy Note 10 and gone with a buttonless design, but it seems now that this isn’t going to be the case.

The buttonless claim came from ETNews, one of the more reliable sources out of Samsung’s home base in South Korea. The site’s sources said that Samsung was mulling the possibility of ditching the volume, power and Bixby keys, replacing them with gestures.

However, Ice Universe, frequent leaker of Samsung information via their Twitter account, has said that this buttonless direction was only investigated initially by Samsung. After testing, they continue, Samsung found that having no buttons was too unreliable, and that the release version of the Note 10 will still have buttons. This is what the most recent unofficial renders now reflect, as you can see here.

Credit: Onleaks/PricebabaCredit: Onleaks/PricebabaMORE: Galaxy Note 10 Could Have This Huge Design Change

Interestingly, Samsung has patented technology that places sensors on the sides of the device to activate certain features. It’s also possible that the way you touch or squeeze the Galaxy Note 10’s sides could prompt an action.

Plenty of cameras

Samsung could try to top its Galaxy S10 models with a Galaxy Note 10 that offers not three, but four cameras on the rear. That would match the number that Huawei has on its flagship P30 Pro phone, and that the Galaxy S10 5G has too.

Samsung's Galaxy S10 5G sports four rear cameras. Samsung’s Galaxy S10 5G sports four rear cameras.

It’s now believed that only the Note 10 Pro will get all four cameras, while the Note 10 will have three. According to SamMobile, the quad-camera setup would pave the way for Samsung to offer a standard camera, a telephoto lens, like the 5x optical zoom lens Samsung is just putting into production, and an ultrawide snapper like the Galaxy S10 and Galaxy S10 Plus. It’s unclear what the fourth camera would offer, but it could be similar to the rear-facing depth sensor Samsung has bundled with the Galaxy S10 5G.

However, the primary sensor might not be as powerful as we initially hoped. Samsung’s new 64-megapixel ISOCELL sensor will not appear in the Galaxy Note 10, according to a tweet from well-known leaker Ice Universe, and a source speaking to Forbes.

Credit: PhoneArenaCredit: PhoneArena

Ice Universe more recently commented that the primary camera will not be getting an upgraded sensor at all. This means that the hardware the camera uses will be the same as the Galaxy S10, and as all of Samsung’s flagship devices since the Galaxy S7, with next year’s S11 moving to a better version. It’s still a solid piece of camera tech, but it will be annoying for people looking to upgrade to the Note 10 after skipping a few generations that they’re missing out on a significant photography improvement by a single model.

This could prove to be something of a setback for the handset’s camera, as other companies like Huawei and OnePlus have been employing sensors with astronomically high megapixel counts in recent years. 

The layout of the cameras was initially a point of contention, but rumors seem to have now settled on two sections arranged on the top left corner of the Ice Universe tweeted an image of what was claimed to be the Note 10’s rear sensor block, plus an illustration to show how these indicate that the cameras will be split: the main, zoom and wide lenses on one side and the flash, ToF camera and flood illuminator on the other.

Credit: IceUniverseCredit: IceUniverse

5G versions

There might 4G and 5G Galaxy Note 10 versions in the works, if a recent XDA Developers leak is any indication.

The site recently discovered some code baked into Samsung’s kernel that points to a “davinci5G.” At first blush, that might not mean much, but Da Vinci is believed to be the code-name for Samsung’s Galaxy Note 10. And the 5G mention is obviously a reference to a 5G version.

MORE: Hands-on Galaxy S10 5G Review: Now This Is Big

Snapdragon 855

Samsung is expected to deliver the same Qualcomm Snapdragon 855 you can find in the Galaxy S10 lineup in the Galaxy Note 10. But there also looks to be an Exynos 9825 version too.Galaxy Note 9Galaxy Note 9

We have seen what look to be benchmarks for the Note 10 5G versions, which show that there is also the Samsung-made Exynos chip available alongside the Snapdragon, depending on who you buy the phone from. The test results show the Snapdragon processor is more powerful though, beating even the 855-equipped Galaxy S10+. The Exynos processor is still plenty powerful enough according to the Geekbench 4 tests, but users seeking true phablet power will want to look for the Note 10 containing the Qualcomm processor.

These results do not apply to the normal Note 10s, which will be released first, but we would hope for at least similar performance.

In-display fingerprint sensor

Galaxy S10Galaxy S10

Again, this one hasn’t been confirmed by Samsung, but all signs point to the company bringing the same in-display fingerprint sensor it offered in the Galaxy S10 to the Galaxy Note 10. The feature is one of the biggest upgrades in the Galaxy S10, and since the Galaxy Note 10 will aim for the same high-end market segment, it makes sense to look for it in Samsung’s next flagship.

The S Pen gets a refresh

Galaxy Note 9Galaxy Note 9

Some people believe that Samsung’s use of the “Da Vinci” code-name points to some big upgrades for the S Pen and its performance with drawing and art. There’s not much else to go on in a Softpedia report on the Da Vinci name and the S Pen, but the Galaxy Note does deliver S Pen upgrades each year — with the Note 9, Samsung added Bluetooth connectivity — so clearly something big could be in the works for artists.

So long, headphone jack?

Galaxy Note 9Galaxy Note 9

This one might not go over so well, but the Galaxy Note 10 could be the first Samsung smartphone not to ship with a headphone jack, according to a report from ETNews that’s been amplified in subsequent Note 10 renders. The move could mean that future Samsung devices could similarly ship without a headphone jack. Bring on the adapters!

Credit: Tom’s Guide

Follow threeblocksaway | styleandeasy