Skip to main content

Your Next Phone Might Come Without a USB Cable

3 weeks 1 day ago
Android Authority notes the start of a new trend we're seeing in some new smartphones: devices shipping without USB cables. It follows the earlier industry shift away from bundled charging bricks, which Apple started back in 2020 with the launch of the iPhone 12. While manufacturers cite environmental benefits, "the main driver behind these decisions for companies like Apple and Sony is, of course, profit," writes Android Authority's Taylor Kerns. From the report: Now, it looks like we may be in for a similar shift with bundled USB cables. As shared on the Linus Tech Tips subreddit, user Brick_Fish's recently purchased Sony Xperia 10 VII came without a charger or a charging cable. In a photo included with the post, you can see iconography on the back of the phone's box that spells out these omissions. Sony's not really a major player in the smartphone space these days, but this seems like the type of trend we should expect to see gain traction over the next couple of years. [...] Apple actually beat Sony to the punch here, in a way. The company's latest earbuds, the AirPods 4 and AirPods Pro 3, both ditched bundled USB cables, as well. Still, Sony's the first manufacturer I've heard of to omit charging cables with its smartphones.

Read more of this story at Slashdot.

BeauHD

Security Bug In India's Income Tax Portal Exposed Taxpayers' Sensitive Data

3 weeks 1 day ago
A now-fixed security flaw in India's income tax e-filing portal exposed millions of taxpayers' personal and financial data due to a basic IDOR vulnerability that let users view others' records by swapping PAN numbers. "The exposed data included full names, home addresses, email addresses, dates of birth, phone numbers, and bank account details of people who pay taxes on their income in India," reports TechCrunch. "The data also exposed citizens' Aadhaar number, a unique government-issued identifier used as proof of identity and for accessing government services." From the report: The researchers found that when they signed into the portal using their Permanent Account Number (PAN), an official document issued by the Indian income tax department, they could view anyone else's sensitive financial data by swapping out their PAN for another PAN in the network request as the web page loads. This could be done using publicly available tools like Postman or Burp Suite (or using the web browser's in-built developer tools) and with knowledge of someone else's PAN, the researchers told TechCrunch. The bug was exploitable by anyone who was logged-in to the tax portal because the Indian income tax department's back-end servers were not properly checking who was allowed to access a person's sensitive data. This class of vulnerability is known as an insecure direct object reference, or IDOR, a common and simple flaw that governments have warned is easy to exploit and can result in large-scale data breaches. "This is an extremely low-hanging thing, but one that has a very severe consequence," the researchers told TechCrunch. In addition to the data of individuals, the researchers said that the bug also exposed data associated with companies who were registered with the e-Filing portal. [...] It remains unclear how long the vulnerability has existed or whether any malicious actors have accessed the exposed data.

Read more of this story at Slashdot.

BeauHD