Tricks n Tips on How To Upgrade Your Android Phone

The biggest problem with the Android platform has been how slowly many phone makers release the latest version of the OS for their older models. It's also not unusual for them to never do so. (A company may not want to spend resources on phones they no longer sell; or, they and the carrier for a particular model may not agree on when to provide an update.)

If you own such a neglected phone, and don't want to buy a new one, then your best shot is installing unofficial Android firmware on it.

The following is a primer on what you should know about the process of installing unauthorized Android firmware. Each phone can have its own unique steps for doing this, so you should follow instructions for your specific model.

1. INSTALL AT YOUR OWN RISK

Installing unofficial OS firmware on your phone will likely render whatever warranty from its maker you have on it null and void.

Thoroughly read the installation instructions for your specific phone model and then follow them carefully, taking time and patience. Though the odds of bricking your phone -- rendering it inoperable because of something going wrong during the install process -- is fairly low, it can happen and especially so if you rush through things.

Be aware that some features on your phone running its current version of Android may no longer be available after you successfully install a custom Android firmware. Other features could be buggy or have quirks.

2. TWO CHOICES: CYANOGENMOD OR MIUI

In the unofficial Android firmware development community, there are two major choices: CyanogenMod and MIUI. Both are built on the Android source code officially released by Google, and their latest versions are based on Android 2.3 (codenamed Gingerbread). As of this writing, the volunteer development teams of both projects are working to get new versions built on Android 4.0 ("Ice Cream Sandwich").

What's the difference between the two? CyanogenMod sticks with the basic, default components of Android that come with its source code release; its UI is "clean," devoid of unnecessary extras. MIUI completely overhauls the stock Android UI with one that resembles that of Apple's iOS.

If your Android phone is (or was) a popular model, it is probably supported by either the CyanogenMod or MIUI community.

If not, there is still a chance that somebody may be working on a port for your specific phone; search its model name in the official community forums for CyanogenMod or MIUI to see if there is such an on-going effort. (An excellent source to check is Android Forums.) But know that some or several features of your phone may not work if you install such an experimental, work-in-progress build of CyanogenMod or MIUI that is not officially sanctioned by that OS's community.

3. ROOT YOUR PHONE

Before you can start to do anything to your phone, you'll need to root it, which means basically to unlock the security settings put in place in the OS to prevent it from being altered. Check out GingerBreak to help you conveniently root your phone.

Unfortunately, this app tool might not work on more recent Android phones. This guide provides a list of instructions for rooting several specific phone models.

4. BACK UP YOUR CURRENT FIRMWARE AND PHONE DATA

You really want to do this if you need to re-install your phone's original firmware and data later (e.g., something goes wrong when you install the unofficial Android firmware; you decide you don't like CyanogenMod or MIUI; or, you need to reactivate your phone with its carrier, something which you cannot do when running either of these unofficial OSs on it).

The easiest way to do a back-up is to install ClockworkMod ROM Manager on your phone. Run this app, and select "Reboot into Recovery" from its menu. This downloads and installs a recovery image profile for your phone, restarts it, and loads a plain-looking text menu, where you can select the back-up process.

After the copy of your phone's firmware and data is made, you can move it to a computer for safekeeping. Connect your phone by USB cable to your computer, then simply drag-and-drop the backup's folder (it's on your phone's SD card under the folder "clockworkmod") from your phone's SD card to the latter device.

5. PREPARE GOOGLE'S DEFAULT ANDROID APPS FOR INSTALLATION

If you're installing CyanogenMod: Unless you want to keep your to-be-upgraded phone clean of Google apps, you'll need to install them separately. CyanogenMod does not include the standard Google apps that typically come pre-installed on an Android phone. So you'll have to download a ZIP file that contains the installation packages for apps such as Google Search and, most importantly, the Android Market. Put this ZIP in the main root directory of your phone's SD card.


6. INSTALL THE CUSTOM ANDROID FIRMWARE

This is the big deal. Download the CyanogenMod or MIUI firmware designed specifically for your phone model, which comes in the form of a ZIP package, and save it in the root directory of your phone's SD card.

Once again, run the ClockworkMod ROM Manager app, and select "Reboot into Recovery." After your phone restarts into the ClockworkMod Recovery tool, you may need to wipe out its data and cache, and format its "/system" directory -- this depends on whether you are installing CyanogenMod or MIUI, so you should refer to the instructions that specifically are for your phone.

Next, you select the ZIP file of the custom Android firmware you placed in the root directory of your phone's SD card, and start the upgrade process. It normally takes less than two minutes. If you're upgrading to CyanogenMod: Don't reboot your phone just yet... repeat the above step for the ZIP file containing the Google Android apps.

You return to the main menu of the ClockworkMod Recovery tool and select to reboot your phone. After about 2 minutes, it should boot and then run on the custom Android firmware.

7. ENJOY YOUR NEW ANDROID PHONE!

Besides updating your phone to a more recent version of Android, CyanogenMod and MIUI can also give it new features and tools, which include better power management, Wi-Fi tethering, stronger security settings, and broader personal customization of the UI. Many users report their phones run faster with one of these unofficial OSs than with the version of Android that came originally installed on it.

UFC President Hacked After Going toe-to-toe with Anonymous

Summary: Anonymous took control of UFC's Web site briefly and that led to UFC President Dana White calling them 'terrorists.'

In a recent interview, mixed-martial arts chief Dana White suggested that members of the hacktivist group Anonymous were "cowards" and "terrorists."

White, who helped found the Ultimate Fighting Championship, which nation's largest promoter of mixed-martial arts fights, then engaged alleged members of Anonymous in a debate via Twitter about his support for the controversial and now dead Stop Online Piracy Act and the morality of hacking sites as a political statement.

According to a report, Anonymous got the final word. Shortly after the debate, someone posted to the Internet White's social security number, mobile phone number, address and for a brief period his wife's name.

White is only the latest copyright owner or public figure to see their personal information posted to the Web as part of hack attacks launched by Anonymous. The group is accused of circulating personal information belonging to Jeff Bewkes, CEO of media conglomerate Time Warner, and New York Mayor Mike Bloomberg.

The attacks began when Anonymous hacked into UFC's Web site a week ago and briefly redirected traffic to a site associated with the group. That's when White made his comments about cowards and terrorists. On Thursday evening a Twitter debate ensued between White and @YourAnonNews, a Twitter account closely associated with Anonymous.

The debate was heated for a while but then both sides seemed to agree to disagree and that was it. Or at least that was it until White's personal information was published.

This is what White told MMA Fighting which seemed to draw the ire of Anonymous: "The way this whole thing has gone down, them hacking our site is the best thing they ever could have done for us. Because what that does is, now, you look like terrorists and now a lot of people who were afraid of you now hate you. Is this bill (SOPA) perfect? No. No bill is perfect. I think this thing started off with the right idea. Stealing is stealing.

You can read the entire Twitter debate here.

Android Malware Now Exploits Steganography

Summary: Malware makers are turning to quite sophisticated tricks to disguise the true purpose of rogue applications.

Security firm F-Secure have released details on how Android malware makes use of steganography to hide the control parameters for rogue code.

First, what is steganography? It’s the technique of hiding messages within something else, in this case, an icon file.

F-Secure first suspected that Android malware was making use of steganography when researchers came across this line of code:

Further digging revealed more code, and it soon became clear that the image file being referenced here was the icon file bundled with the rogue application:

So what’s this hidden information used for? It’s used to control how and when premium rate SMS messages are sent from the victim’s handset, which, as far as the bad guys are concerned, is the primary purpose of the rogue application.

You’ve got to admit, that’s a pretty clever use of steganography.

Ntoskrnl.exe corrupt Permanent Solution

ntoskrnl.exe (and ntkrnlpa.exe on systems with Physical Address Extension support) is the kernel image for the family of Microsoft Windows NT operating systems. It provides the kernel and executive layers of the Windows NT kernel space, and is responsible for various system services such as hardware virtualization, process and memory management, etc., thus making it a fundamental part of the system. It contains the cache manager, the executive, the kernel, the security reference monitor, the memory manager, and the scheduler, among other things.

Remedy

Boot to the installation CD.
When offered the choice to Install, Repair, or Quit, select repair.
When prompted select the installation you want to repair (usually "1" ).
When prompted enter the administrator password (if any).
The screen will show:

C:\Windows

Find the drive letter of your CD by typing:

cd D:\

If that finds the CD, it will show

D:\

on the screen.

Then type

copy ntoskrnl.exe C:\WINDOWS\SYSTEM32

and press the enter key.

The next line should show it was successfully copied.

Power-off.
Power-on.
The computer should now POST and boot into xp64.

Download uTorrent - a (very) tiny BitTorrent client

µTorrent (or uTorrent; commonly abbreviated as "µT" or "uT") is a freeware, closed source BitTorrent client now owned by BitTorrent, Inc. It is the most widely used BitTorrent client outside China (where Xunlei is more popular). It gets the "µ" in its name from the SI prefix "micro-", referring to the program's small memory footprint: the program was designed to use minimal computer resources while offering functionality comparable to larger BitTorrent clients such as Vuze or BitComet. The program has received consistently good reviews for its feature set, performance, stability, and support for older hardware and versions of Windows.

The program has been in active development since its first release in 2005. Although originally developed by Ludvig Strigeus, since December 7, 2006, the code is owned and maintained by BitTorrent, Inc. The code has also been employed by BitTorrent, Inc. as the basis for version 6.0 and above of the BitTorrent client, a re-branded version of uTorrent.

uTorrent is available for Microsoft Windows, Mac OS X and Linux. A uTorrent Server is also available for Linux. All versions are written in C++.

Download uTorrent

Windows  //  Mac  //  Linux

Anonymous Attacks RIAA, MPAA, Department of Justice Websites

Although we haven’t heard much from them lately, the hacktivist group Anonymous is claiming credit on Twitter that it has attacked the websites belonging to government agencies as well as the entertainment industry on Thursday.

So far, Anonymous has successfully shuttered the websites belonging to the U.S. Department of Justice, the Recording Industry Association of America (RIAA), the Motion Picture Association of America, and Universal Music.

On Thursday afternoon, the sites of the former three organizations were completely down, while Universal Music’s page only read “The Site is under maintenance. Please expect it to be back shortly.”

The security breaches come after several arrests this morning concerning Megaupload, a file sharing service company.

They can also be summed down to the sentiments in this AnonDaily tweet:

#StarveTheBeast Trend this. The entertainment industries will see that they can not simply censor us for the basis of profit.

These events also come one day after many websites, including Wikipedia and Reddit, went dark to protest the Stop Online Piracy Act (SOPA) and the PROTECT IP Act (PIPA).

The group is reportedly also going after WhiteHouse.gov, but that portal was still up and running normally at the time this post was published.

Anonymous also threatened (and successfully thus far) launched mass DDoS attacks against music royalties firm BMI and the U.S. Copyright Office.

Previously responsible for many other notable attacks and inciting protests across the globe last year, Anonymous boasted today’s events as its “the largest on scale attack ever” at a record of 10 sites in 20 minutes.

Based on Anonymous’ Twitter feed, we can also expect attacks the sites of the Federal Bureau of Investigation, Viacom, The Regents of the University of California, former U.S. Senator Christopher Dodd (also chairman and CEO of the MPAA), and any organization that has publicly voiced support for SOPA.

Sony website defaced by second hacker

A defacer affiliated with Anonymous vandalised Sony's online front door this week over the corporate behemoth's support of SOPA, a hated anti-piracy law proposed in the US.

The Sony Picture's website was defaced and clearly unauthorised comments were posted on the media giant's Facebook page. The digital graffiti was scribbled by a hacker who uses the Twitter handle s3rver_exe. Both acts of vandalism were rapidly purged, while the YouTube video illustrating the hack was quickly pulled.

Neither cyber-assault was significant as the perp readily concedes. Even so, the latest security breach doesn't reflect well on Sony's much vaunted efforts to bolster its electronic defences following last year's PlayStation Network hack, which forced Sony to take down its gaming platform for weeks.

In an ironic twist, the Twitter account of @s3rver_exe was hacked on Friday in the wake of the #OpSony pawnage.

"Sony was hacked because the admin panel was not encrypted ROFL. And I have got my account back," s3rver_exe said. "I don't know why the hacker hacked me. I think he did it for the lulz."

"The hack wasn't big but still the servers were vulnerable and I got access to the admin too," he later added.

List of Facebook Keyboard Shortcuts

Facebook has a small, but useful set of keyboard shortcuts you can use to navigate the social networking site.

The shortcuts work best with Chrome in Windows and Firefox on Mac OS X, because they only need one modifier key, plus the shortcut key. Also keep in mind that the number shortcuts must be pressed from the number row; they don't work with the number pad.

Here are the keyboard shortcuts for Facebook:

Windows
Firefox modifier: Shift + Alt + #
Chrome modifier: Alt + #

Mac
Firefox modifier: Control + #
Chrome modifier: Control + Option + #
Safari modifier: Control + Option + #

Shortcuts
1 : home
2 : timeline/profile
3 : friends
4 : messages
5 : notifications
6 : general account settings
7 : privacy settings
8 : Facebook's Facebook page
9 : legal terms
0 : help center
m : new message
? : search

That's it. If you're wondering why Internet Explorer 9 was left out, it's because only the home and timeline shortcuts seem to work. If you want to use IE9 anyway, the modifier is Alt + #, then Enter.

Worm compromises 45,000+ Facebook logins

A nasty bit of malware making the rounds on Facebook has reportedly made off with the usernames and passwords of more than 45,000 users.

Most of those affected by the worm--called Ramnit--are from France and the United Kingdom, according to a bulletin issued by security researchers at Securlet. It is capable of infecting Windows executables, Microsoft Office, and HTML files, according to McAfee.

"We suspect that the attackers behind Ramnit are using the stolen credentials to log-in to victims' Facebook accounts and to transmit malicious links to their friends, thereby magnifying the malware's spread even further," Securlet said in its bulletin. "In addition, cybercriminals are taking advantage of the fact that users tend to use the same password in various web-based services (Facebook, Gmail, Corporate SSL VPN, Outlook Web Access, etc.) to gain remote access to corporate networks."

The worm was first discovered in April 2010 stealing sensitive information such as stored FTP credentials and browser cookies. In August 2011, after malware developers borrowed source code from the Zeus botnet, Ramnit "went financial." With that added strength, Ramnit was able to "gain remote access to financial institutions, compromise online banking sessions and penetrate several corporate networks." Approximately 800,000 machines were infected between September 2011 and the end of the year.

The security researcher has notified Facebook and provided the social-networking giant with all the stolen credentials found on Ramnit's server.

Researchers discovers keylogging threats in Mozilla

Security researcher Mario Heiderich reported to the maker of Firefox last year that he had found an unusual vulnerability in the browser and two other Mozilla products that run on the Gecko engine, Thunderbird, and SeaMonkey. Based in the relatively new technology that allows for animated complex vector graphics in the browser, called SVG animation, the vulnerability allowed for a malware writer to detect key strokes even when JavaScript was disabled.

Basically, he found a way to turn innocuous Web pages into keyloggers. Mozilla patched the vulnerability in Firefox 9, Thunderbird 9, and SeaMonkey 2.6. Then, as is standard operating procedure, they announced to the public what the threat was and that it had been fixed. But the real threat may lie in what the threat wasn't: it wasn't based in JavaScript.

"The basic premise of my research currently is scriptless attacks, meaning attack vectors working in a post-XSS world," Heiderich said in an e-mail. He defined a "post-XSS" world as one where the cross-site scripting attack had been more or less minimized by technologies like sandboxed iFrames, Mozilla's e-mail client Thunderbird and Firefox's Content Security Policy, the JavaScript blocking browser add-on NoScript, and Windows 8.

"The desired goal was to do keystroke logging in the browser, doing so without necessitating JavaScript, so even if you turned off JavaScript it would work," said Jeremiah Grossman, Chief Technical Officer at computer security research firm White Hat Security. "All the browser developers are fixing cross-site scripting. What half a dozen researchers are exploring is what you can do attack-wise in a browser without JavaScript. They're discovering that there's still quite a lot you can do in the browser."

This particular SVG keylogging attack was quite nasty, said Chris Eng, vice president of research at Veracode, a computer security research firm. "The way [it] works is that [the bad guy] binds the letter "a" to an action that causes the browser to sliently issue a request for http://evil.com/?a. Pressing "b" would trigger the browser to silently issue a request for http://evil.com/?b. By "silently" I mean that there's no visual cues to the user that anything is happening--if you were monitoring the network you would see the requests. As long as the attacker controls evil.com and can access the web server logs, he can piece together what the victim is typing, one character at a time."

Eng noted that this kind of problem always erupts whenever new standards are rolled out, especially with "extremely detailed and sometimes difficult to understand" attributes. You don't have to go far to find evidence of this, either. Both Mozilla and Google offer hefty bounties for bug-hunters. Eng both cautioned against screaming that the sky was falling and said that this kind of attack was inherently more interesting to researchers.

As unlikely as Eng said it is for an average browser user to fall victim to these atypical but hard to implement attacks, Heiderich warned that it's not anomalous. "The SVG keylogger is just one example of many, and by far not the most impact ridden one," said Heiderich.

Another factor is that the major browser makers, including Google, Mozilla, Microsoft, Apple, and Opera, are all fairly responsive to fixing these threat vectors when discovered, said Grossman. But that doesn't mean that there aren't steps for the home user to take.

One way to minimize the risk from this kind of modern threat is to compartmentalize your risk, he said. "The best way [to protect yourself] is behavior, not product. Whether in Firefox, IE, or Chrome, I would use any one of the major browsers for secure browsing, such as banking or Facebook. For promiscuous browsing, such as news surfing, I use a different browser.

Eng concurred and said that there aren't many defenses against attacks that don't rely on JavaScript. "You usually have to just wait for the browser bugs to be fixed. So my options are more limited--either don't use that browser at all, use a completely separate browser for trusted sites versus untrusted ones, [or] stay off the Internet."

Free Windows 8 Beta Download (Consumer Preview)

Windows 8 is the official name for the next version of Microsoft Windows, a series of operating systems produced by Microsoft for use on personal computers, including home and business desktops, laptops, netbooks, tablet PCs, and media center PCs. According to unofficial sources, the release date for Windows 8 has been set for October 2012, three years after the release of its predecessor, Windows 7. Windows 8's server counterpart, Windows Server 2012, is in development concurrently with Windows 8. The most recent officially released pre-release version is the Consumer Preview, which was released on February 29, 2012. An almost-complete Release Preview is scheduled for June 5, 2012.

Unlike Windows 7, which was intended to be a more focused, incremental upgrade to the Windows line, Windows 8 has been “reimagined from the chipset to the user experience” to connect more with the user. It features the Metro interface that is designed for touchscreen input similar to that in Windows Phone and on the Xbox 360. A version of Windows 8, called Windows RT, also adds support for the ARM processor architecture in addition to the previously supported microprocessors from Intel and AMD.

Downloading Windows 8 Beta

Windows setup (with tools to create an ISO or thumb drive)

http://windows.microsoft.com/en-US/windows-8/download

ISO image (use Disk Image burner or USB tool)

http://windows.microsoft.com/en-US/windows-8/iso