Download me—Saying “yes” to the Web’s most dangerous search terms

by Conor Myhrvold - Jun 25, 2013 1:00 pm UTC

There’s a saying—"there’s no such thing as a free lunch." On the Web, however, it sure seems like there is. In the time span of a lunch break, a few keywords in a search engine promise free entertainment, just several clicks away. We all know the catch, though. These freebies can come with freeloading adware, malware, and other unwanted programs and plugins. This was particularly true in the Internet’s early days, but in the past decade, tech giants such as Google, Microsoft, and Yahoo—the three major players in search today—have deployed significant resources to prevent adware and malware from compromising their Web browsers, e-mail services, and websites. It can't be that bad in 2013, right?

Answering this question required a little experiment, one inspired by the documentary Super-Size Me. That film chronicles Morgan Spurlock’s month-long fast food “diet” during which he limited his exercise and knowledge about healthy eating, had to order everything on the McDonald’s menu at least once, and never said no to an upgrade offer.

Allie Brosh, Hyperbole and a Half

The Web version of this is simpler and better for an individual's (physical) health. From a clean computer fresh off an OS install, enter some of the most popular, plausible generic free keyword searches on a popular Web browser. Next, open all of the links in the search results (ads and otherwise) and download the first thing on the landing pages, recording where it went and what it did. Like Spurlock, I would limit my knowledge about what was safe or risky and take no (Internet) precautions beyond the default settings. The same rules applied for installing the program afterward. And in the Web's version of "would you like to super-size that?" I had to say yes to whatever was offered. There would be no avoiding a Web culture of excess and extras.

More programs included with the installation? MOAR! After each keyword search and installation was complete, I’d run several (free) popular antivirus programs to detect unwanted programs and record the installed programs, browser plugins, and extensions. That way it's easy to check later for Internet notoriety.

After a little research, I decided to search for free games, music, e-cards, a wallpaper, and a screensaver for my new computer. This appears to cover a spectrum of entertainment options available on the Web, but several ground rules guided me in selecting these items:

The content had to be plausibly free (“free” had to be the leading keyword) and legal (no purposefully targeting torrents, P2P).To replicate the high bounce rates common for Internet browsing, I exited if I needed to create an account or provide an e-mail or login. I also exited if there was no immediate download option from the landing page, although I was happy to click through several pages or redirections if it promised a free download (though it couldn’t be an unrelated third-party ad).The searched-for content had to be entertainment-oriented (no malware/spyware/antivirus searches), but it could not come from adult sites (online gambling, porn, webcams). In other words, the idea was to look for fun, free stuff—not trouble directly.

To no one's surprise, the keywords I selected were popular. However, they were also really, really dangerous. Each search qualified for the "Top 50 Most Riskiest Search Terms in the US" list from McAfee's 2008 roundup, The Web’s Most Dangerous Search Terms report. This experiment even included a pair of No. 1 ill-advised searches:

"free e-cards," listed in the McAfee Top 50, US

"free game cheats," “game cheats” qualifies as a McAfee Top 50

"free games," noted as popular generic search query

"free lyrics," “lyrics," and “song lyrics” were among the McAfee Top 50

"free music downloads," the No. 1 term for Average Risk, McAfee Top 50

"free screensaver," noted as a popular generic search query

"free wallpaper," “wallpaper” is a McAfee Top 50

"free word unscrambler," the No. 1 term for Maximum Risk, McAfee Top 50

In the McAfee report, "free" had the highest category risk. When you run software from an untrusted source, it exposes information about your operating system to the installer, such as your computer model, your IP address, your programs, and what browser you have. And if you are installing software from an adware kingpin, revealing this information is not good. Your information is directly on its way to the adware server.

A computer security expert I consulted beforehand pointed out a potential foil to my experiment. Since I would be installing many adware programs in a short time period—some likely from the same source through different adware networks controlled by the same entity—there was a chance my IP address would be flagged as a particularly gullible user. Other devices using that same IP address later could be vulnerable to a targeted attack if I used a fixed IP address or a narrow range. This required a simple shift. To increase anonymity, free public Wi-Fi was used (and it's likely where you could typically expect some of the downloading behavior I was about to replicate). Combine this with a clean install containing no personal information, and the experiment was as safe as anything involving McAfee may get.

So were these search risks, like human gullibility and those looking to profit from it, timeless or just trends of 2008?

Since Windows is the dominant operating system today, I used a MacBook Pro with a Windows 7 64 bit OEM virtualization via Parallels 7. This functioned basically as a PC petri dish and a sandbox for the potentially dangerous software. I could revert to the original pre-search image after each query—back to default programs with only Mozilla Firefox (one of the three most widely used Internet browsers) and two free popular malware detection programs, Microsoft Security Essentials and Lavasoft’s Ad-Aware.

For each search, I opened a new browser window in Mozilla Firefox—in private browsing mode—and navigated to Google’s search homepage. I saved the image of the clean computer state to Parallels, allowing me to run each search term in a standardized fashion before reverting to the beginning again.

Let the games (and lyrics, and other downloads) begin.

Enlarge / Desktop before search No. 1...
Enlarge / Web browser before search No. 1...

Expand full story

Page: 1 2 3 Next ?

View the original article here

Adobe Flash exploit grabs video and audio, long after “fix”

Sign up for the Ars Technica Dispatch, which delivers links to the most popular articles, journals, and multimedia features via e-mail to your inbox every week.

I understand and agree that registration on or use of this site constitutes agreement to its User Agreement and Privacy Policy.

View the original article here

Android flaw allows hackers to surreptitiously modify apps

Enlarge / A screenshot of an Android device that's been hacked by modifying the device manufacturer's application. The hack gives access to all permissions on the device.

Researchers said they've uncovered a security vulnerability that could allow attackers to take full control of smartphones running Google's Android mobile operating system.

The weakness involves the way legitimate Android applications are cryptographically signed to ensure they haven't been modified by parties other than the trusted developer, according to a blog post published Wednesday by researchers from mobile security startup Bluebox. The flaw has existed since at least the release of Android 1.6 almost four years ago. Hackers who exploit the vulnerability can modify app code to include backdoors, keyloggers, or other malicious functionality without changing the verification signature.

Malicious apps that exploit the vulnerability would enjoy the same system privileges as the legitimate one. That access could be especially dangerous if the app that's modified originated with the handset manufacturer or third parties that partner with the manufacturer, Wednesday's blog post said. That's because such apps are typically granted elevated privileges within the Android OS.

"The application then not only has the ability to read arbitrary application data on the device (e-mail, SMS messages, documents, etc.), [and] retrieve all stored account & service passwords, it can essentially take over the normal functioning of the phone and control any function thereof (make arbitrary phone calls, send arbitrary SMS messages, turn on the camera, and record calls)," the blog post said. "Finally, and most unsettling, is the potential for a hacker to take advantage of the always-on, always-connected, and always-moving (therefore hard-to-detect) nature of these “zombie” mobile devices to create a botnet."

While it would be devastating if an attacker was able to get such a modified APK into the Google Play Store, or somehow use the technique to hijack the update mechanism of legitimate apps, there are probably safeguards already in place to prevent such attacks.

"I imagine that Google would move quickly to add some logic to look for such attacks," Dan Wallach, a professor specializing in Android security in the computer science department of Rice University, told Ars. "Without that available to an attacker, this is likely to only be relevant for Android users who use third-party app stores (which have lots of other problems). This bug could also be valuable for users trying to 'root' their phones."

Blue box researchers privately reported the vulnerability to Google in February.

View the original article here

Stanford, Mozilla, Opera team up to tackle cookie privacy issues

For the past few months, Firefox alphas have been heuristically blocking certain cookies in a bid to protect user privacy and reduce the amount of online tracking by advertisers. Mozilla has not moved this blocking into the stable builds of its browser, however, because of problems with its effectiveness. The heuristics aren't perfect, so sometimes it blocks cookies it shouldn't block and other times lets cookies through that it should block.

A new project from Stanford University could provide the solution. The Cookie Clearinghouse intends to provide lists of cookies that should be blocked or accepted. Still in the planning stages, it will be designed to work in concert with the heuristics found in Firefox in order to correct the errors that the algorithmic approach makes.

Firefox's algorithm is simple. Essentially, if you visit a domain directly, that domain will be able to set cookies (first-party cookies) and it will continue to be permitted to set cookies even when visited indirectly (third-party cookies). For example, if you visit facebook.com, it will be allowed to set cookies both for explicit visits and whenever other sites embed Facebook content such as like buttons.

Conversely, if you've never directly visited a domain, that domain won't be allowed to set cookies at all. If you've never once visited Facebook then the embedded Facebook content won't be able to set any cookies.

As a rule of thumb, this works reasonably well; Safari has used this same algorithm for some time. However, it's not perfect. Some sites use multiple domains. A visit to the site should treat these domains as first-party (as they're still owned, operated, and controlled by the same people who run the site), but under this heuristic it won't. The Cookie Clearinghouse gives a hypothetical example: stanford.edu could load its images from domain stanford-images.edu. This would fall foul of the algorithm.

There can also be problems in the other direction. An accidental click on an advertisement will elevate the advertiser's domain to being an explicitly visited first party, and that will allow the advertiser's third-party cookies to work. That's probably not what you want to do.

Apple's solution for the problem, such as it is, is to disable the cookie blocking entirely should it cause a problem. That works, but Mozilla isn't keen on it. Mozilla CTO Brendan Eich writes that users tend to just leave the setting off forever, attaining no privacy protection at all.

The Cookie Clearinghouse is the solution. It will produce lists enumerating both cookies that should be allowed but aren't, and cookies that shouldn't be allowed but are. Browsers can then use these lists to shore up the algorithmic approach. The plan is to also allow site owners to challenge inclusion on the block list and present an argument for why their cookies should be allowed.

As well as Stanford staff, the Cookie Clearinghouse's advisory board includes representatives from Mozilla and Opera. Mozilla is inviting feedback and promoting the Cookie Clearinghouse as a neat solution to cookie privacy issues.

Advertisers appear to be less keen. Speaking to The Washington Post, Randall Rothenberg, president of the Interactive Advertising Bureau (an organization of advertisers and media companies), said that "there are billions and billions of dollars and tens of thousands of jobs at stake in [the advertising] supply chain." He continued. "[Changes in browser behavior] should be done with stakeholders' input." (Condé Nast, parent company of Ars Technica, is a member of the IAB.)

The algorithmic approach, combined with the lists to patch up the algorithm, also sidesteps another Web privacy issue that has been rumbling for a couple of years: Do Not Track. The Do Not Track specification described a request that browsers can send to Web servers to indicate that their users don't want to have their Web activity tracked by servers.

Its development has been fraught with controversy. To be useful, Do Not Track requires advertisers to opt in and explicitly choose to support it. Naturally, they're reluctant to do so, as it limits their ability to target ads to users. Accordingly, the spec says that the Do Not Track request cannot be sent by a browser by default: it must require a user opt-in.

Microsoft, in the name of greater privacy, threw a cat among the pigeons and turned Do Not Track on by default. The company justified its decision by saying that it still forced users to click through settings screens when first using Internet Explorer 10 and hence still had user consent.

The specification has other issues, such as a definition of "tracking" that might not square well with user expectations (analytics and advertising companies are still allowed to perform some kinds of tracing of Do Not Track users). There's also an unrestricted right for first parties to track users, even if they don't want to be tracked.

The conflicting views and incompatible demands threatened to derail the standard but it may yet limp towards some sort of outcome. The group working on the spec is due to finish their work in July. Getting agreement among the various parties seems impossible, so the options are to give up entirely, to force through changes that not everyone agrees on (something that the group's co-chairs can do), or to weaken the language and terminology of the spec to make it so meaningless that everyone will agree to it.

The algorithmic approach with the Cookie Clearinghouse should prove to be a more robust privacy system and one that doesn't depend on the consent of advertisers. If the browser blocks a cookie then there's nothing an advertiser can do about it.

Listing image by Jeramey Jannene

View the original article here

Attackers sign malware using crypto certificate stolen from Opera Software

Hackers penetrated network servers belonging to Opera Software, stole at least one digital certificate, and then used it to distribute malware that incorrectly appeared to be published by the browser maker.

The attack was uncovered, halted, and contained on June 19, according to a short advisory that Opera published Wednesday morning. While administrators have cleaned the system and have yet to find any evidence of any user data being compromised, the breach still had some troubling consequences.

"The attackers were able to obtain at least one old and expired Opera code signing certificate, which they have used to sign some malware," Wednesday's advisory stated. "This has allowed them to distribute malicious software which incorrectly appears to have been published by Opera Software or appears to be the Opera browser. It is possible that a few thousand Windows users, who were using Opera between June 19 from 1.00 and 1.36 UTC, may automatically have received and installed the malicious software."

Opera's advisory leaves out key information that makes it hard to assess just how much damage was done. Missing details include when the attackers first gained access to the servers, precisely when the stolen digital certificate expired, and whether there's reason to believe other certificates may also have been obtained. It would also be useful to know how hackers got access to an official Opera digital certificate, which is supposed to cryptographically prove that the software that bears its seal could only have come from the company. As Ars reported last year, companies such as Symantec go to great lengths to secure such keys, although Opera is hardly alone in losing control of such a valuable certificate.

The advisory also provides few details about the malware that was signed with Opera's official digital imprimatur, other than to link to this VirusTotal analysis. The Opera post urged users to "update to the latest version of Opera as soon as it is available, keep computer software up to date, and to use a reputable antivirus product on their computer."

Opera representatives declined to provide additional details, citing a continuing investigation into the breach. At some point soon, though, officials should provide a more thorough account of what happened, who was affected, and what steps have been taken to prevent similar attacks from succeeding in the future.

View the original article here

How the US (probably) spied on European allies’ encrypted faxes

Enlarge / Part of a secret document published by The Guardian detailing "Dropmire," a program that reportedly spied on encrypted faxes sent to the European Union's Washington, DC, mission.

View all…

US intelligence services implanted bugging tools into cryptographic facsimile devices to intercept secret communications sent or received by the European Union's Washington, DC outpost, according to the latest leak from former National Security Agency staffer Edward Snowden. Technical details are scarce, but security experts reading between the lines say the program probably relies on an old-school style of espionage that parses electric currents, acoustic vibrations, and other subtle types of energy to reveal the contents of encrypted communications.

The bugging method was codenamed Dropmire, and it appears to rely on a device being "implanted on the Cryptofax at the EU embassy, DC," according to a 2007 document partially published Sunday by The Guardian. An image included in the document, presumably taken from a transmission traveling over a targeted device, showed highly distorted text that can just barely be read by the human eye as the letters "EC" followed by "NCN." The fax device was used to send cables between foreign affairs ministries and European capitals, according to Sunday's report.

The ability to approximate the plaintext message but not capture it as it appeared when fully decrypted likely means Dropmire didn't crack the precise algorithm or key used to encrypt the message. That—along with the detail about something being "implanted" in the fax device—has led to speculation that the program monitored electrical, mechanical, or acoustical energy emanating from the device to deduce clues about the plaintext messages being received. Such techniques fall under the umbrella term Tempest, which was coined more than three decades ago as an NSA tactic for reading sensitive communications relating to national security. More recently, Tempest has come to mean any investigation or analysis that uses so-called "compromising emanations" to reveal the contents of sensitive communications or lead to the decryption of encrypted data.

"Having done many experiments to eavesdrop on office equipment myself, the noisy image at the bottom third of the picture above looked instantly familiar," Markus Kuhn, a computer scientist and senior lecturer at Cambridge University, wrote in a blog post published Monday. "It is what you might get from listening with a radio receiver on the compromising emanations of a video signal of a page of text."

Three security experts Ars spoke with agreed with Kuhn's analysis. They said it makes a strong case that the attacks targeting the EU encrypted fax devices were relying on what's known as side-channel attacks, which target weaknesses in a specific cryptographic implementation rather than the underlying cipher or mathematics it's built on.

"It's breaking things that really have nothing to do with the cryptography itself," Justin Troutman, a cryptographer and independent security and privacy researcher, told Ars. He went on to say that the effort required on the part of US intelligence agents was likely justified when considering the intelligence value of the encrypted data. "I think the side-channel attacks are plausible, and I think the target warrants it. So even though it's speculation at this point, it's certainly a valid point within the realm of reason."

Side-channel attacks analyze subtle fluctuations in power drawn by a cryptographic device or slight differences in the amount of time it takes the device to complete certain tasks. The side data is then used to ferret out clues about the underlying plaintext or the key or algorithm that was used to encrypt it. In some cases, side-channel attacks can be used to recover the entire cleartext once enough clues are gathered. Other times, the technique reveals only partial contents of the message.

"One way I've seen other side-channel attacks work is once you convert a signal into a binary, you can hope that it's as easy as reading the data," Troutman explained. "There's going to be noise, so it may take other algorithms to parse through that noise and filter it out. But if you can get bits and pieces, a few letters here, a few letters there, over time you may be able to build a picture of what the conversation is about, or enough to at least identify what this communication channel is used for, or possibly even identify names attached to other projects."

Cryptographic device makers have known about side-channel attacks for decades and often work hard to prevent their wares from leaking clues that can compromise customers' encrypted messages. Hardened devices often use data "padding" to obscure the size of encrypted messages. Devices may also be programmed to ensure there's more uniformity in the amount of time it takes for different types of data to be encrypted or decrypted. They frequently encase cryptographic devices in protective shields that prevent them from leaking electric or other types of emanations that can be analyzed by an adversary. That being the case, how might US intelligence agents carry out a side-channel attack on an encrypted fax device belonging to the EU?

One possibility is to plant some sort of bug on or near a targeted device that captures compromising emanations and delivers them to intelligence agents for analysis. While the data intercepted by such a Tempest-style bug has clear disadvantages—namely, the crudeness of the data it intercepts—it might also be considerably easier to plant and harder for EU defenders to detect. By contrast, a more advanced bug secretly added to a fax device might be able to deliver a more reliable copy of the protected communication while being relatively easy for someone to spot. In some cases, the bug might not be anything that's added but, rather, something removed to permit leakage that wouldn't otherwise occur. The corruption in the image included with The Guardian article suggests the device was closer to the former.

"That the image is so distorted, and getting edges instead of content, indicates that it's something simple, such as adding a wire or removing wire, as the [Kuhn] article indicates," said Rob Graham, CEO of security consultancy Errata Security. "Adding a circuit board would be detectable, snipping a trace on a circuit board to enhance emanations wouldn't be."

It's also possible that the surveillance was conducted by using a bug to analyze radio frequency emissions only after the sensitive data had been decrypted and was in the process of being printed by the fax device. In 2009, for instance, researchers demonstrated two methods for eavesdropping on passwords and other sensitive data by exploiting vibrational patterns and electromagnetic pulses that emanate with every character entered into a computer.

"The laser printer of a fax machine certainly fits the profile and unless specific countermeasures are in place, it might be vulnerable to such eavesdropping techniques, which would not be mitigated by the encryption layer, as they target the end output of the printer," said Andrea Barisani, chief security engineer for Inverse Path and one of the researchers behind the 2009 demonstration. "Our company is often given the task to assess the interaction between physical electronics and software security of embedded devices such as printers and fax machines. In the vast majority of cases, all of the tested targets are vulnerable to software attacks, hardware attacks, or a combination of the two."

The lack of specific details in The Guardian article makes it impossible to know just how accurate speculation is that US intelligence services are launching Tempest-style attacks on its European allies. But based on the information available, it's not possible to rule out these James Bond-type of surveillance techniques either.

View the original article here

Rampant Apache website attack hits visitors with highly malicious software

A campaign that forces sites running the Apache Web server to install highly malicious software on visitor's PCs has compromised more than 40,000 Web addresses in the past nine months, 15,000 of them in the month of May alone.

The figures, published Tuesday by researchers from antivirus provider Eset, are the latest indication that an attack on websites running the Internet's most popular Web server continues to build steam. Known as Darkleech, the rogue Apache module gets installed on compromised servers and turns legitimate websites into online mine fields that expose unsuspecting visitors to a host of dangerous exploits. More than 40,000 domains and website IPs have been commandeered since October, 15,000 of which were active at the same time in May, 2013 alone. In just the last week, Eset has detected at least 270 different websites exposing users to attacks.

Sites that come under the spell of Darkleech redirect certain visitors to malicious websites that host attack code spawned by the notorious Blackhole exploit kit. The fee-based package available in underground forums makes it easy for novices to exploit vulnerabilities in browsers and browser plug-ins. Web visitors who haven't installed updates patching those flaws get silently infected with a variety of dangerous malware titles. Among the malware that Darkleech pushes is a "Nymaim" piece of ransomware that demands a $300 payment to unlock encrypted files from a victim's machine. Other malware titles that get installed include Pony Loader and Sirefef.

"This campaign has been going on for a very long time," Eset malware researcher Sébastien Duquette wrote in Tuesday's blog post. "Our data shows that the Blackhole instance has been active for more than two years, since at least February 2011."

Eset's research is consistent with April coverage from Ars reporting that an estimated 20,000 Apache websites were infected by Darkleech in just a few weeks' time. Sites operated by The Los Angeles Times, Seagate, and other reputable companies were among the casualties. Like Ars, Eset found the Web malware employs a detailed array of conditions to determine when to inject malicious links into the pages shown to end users. Among other things, Eset wrote that users will only be attacked when their browser reports they're using Microsoft's Internet Explorer browser or Oracle's Java plugin. Eset's findings are also consistent with recent figures from Google showing that the vast majority of malware attacks are spawned from legitimate sites that have been hacked.

Darkleech has also been known to pass over visitors using IP addresses belonging to security and hosting firms, people who have recently been attacked, and those who don't access the hacked pages from specific search queries. By being highly selective in targeting potential victims, Darkleech developers make it harder for security defenders to unravel the campaign and block infections. Visitors who are selected are served an HTML-based iframe tag in a Web page from the legitimate site that has been compromised. The iframe exploits code from a malicious site under the control of attackers.

Darkleech, which also goes by the name Linux/Charpoy, is able to tailor exploits to the geographic region of the infected victim as well. Ransomware that infects US-based visitors, for instance, purports to come from the FBI, while ransomware hitting people in other countries is adapted accordingly.

Enlarge / The Darkleech infection flow.

In October, Darkleech underwent a makeover that changed the format of the URL in the malicious iframe so it's harder to detect. It works by decrypting four different text strings and then calculating a cryptographic hash to determine if a visitor should be served an iframe. The randomly generated link that leads to the attack site is extremely hard to detect as malicious except for its telltale ending "q.php."

As has been the case with previous investigations, researchers still don't know how the Darkleech module takes initial hold of the sites it infects. Speculation has surfaced that the servers are compromised by exploiting undocumented vulnerabilities in the CPanel or Plesk tools administrators used to remotely manage sites, but there's no hard evidence to back up that theory. Researchers also reckon sites may be taken over by cracking administrative passwords or by exploiting security flaws in Linux, Apache, or another piece of commonly used software. Darkleech in part uses CPanel and Plesk servers to handle certain aspects of the iframe injection and payload delivery, but other parts rely on the Apache server itself, Pierre-Marc Bureau, Eset's security intelligence program manager, told Ars.

Because there are usually many websites hosted on a single server, there's often multiple domain names pointing to a single IP address, so Eset researchers are unable to determine just how many Apache-powered websites are infected by Darkleech. The total is "probably lower" than the 40,000 estimate, Bureau said.

The Eset report comes two weeks after researchers from security firm Sucuri unearthed a new malicious module infecting Apache servers. They're still not sure if the plug-in is a newer, stealthier version of Darkleech or a completely different tool developed by a rival crime group. Researchers in recent months have uncovered a third piece of malware that causes websites to expose visitors to attacks. Known as Linux/Cdorked, it targets sites running the Apache, nginx, and Lighttpd Web servers and, as of May, had exposed almost 100,000 end-users running Eset software alone to attack.

With so many threats successfully targeting mainstream Web servers, administrators should take care to lock down their systems by following good security hygiene. One step is to ensure all default passwords have been changed to a one that's long and randomly generated. Also key is to make sure all software components—including the operating system and all applications—are fully up to date. It's also not a bad idea to use a website security scanner from time to time and to occasionally check the cryptographic hash of the HTTP daemon of the Web server to make sure it hasn't been tampered with.

View the original article here

A “bionic eye” renders the world in 6×9 resolution for the blind

Sign up for the Ars Technica Dispatch, which delivers links to the most popular articles, journals, and multimedia features via e-mail to your inbox every week.

I understand and agree that registration on or use of this site constitutes agreement to its User Agreement and Privacy Policy.

View the original article here

Report: Apple to stop using Samsung-made chips beginning in 2014

Sign up for the Ars Technica Dispatch, which delivers links to the most popular articles, journals, and multimedia features via e-mail to your inbox every week.

I understand and agree that registration on or use of this site constitutes agreement to its User Agreement and Privacy Policy.

View the original article here

It’s time to say goodbye to Google Reader and hello to something new

The time has come and it’s finally happening: Google will shut down Reader’s doors on Monday. If you haven’t already done so, you should probably start migrating over to a new reader application on your Android device. Thankfully, the Google Play store is chock full of applications that serve this exact purpose. They all work the same way, but they all offer different interfaces and features. You might find one of these applications worth downloading this weekend. And if you've found an app you particularly like, let us know.

Feedly, Free 

Feedly has been getting a lot of press lately for picking up the slack that Google is leaving behind. The company effectively launched its own reader API earlier this month with support for other third-party applications—some of the apps we've listed here have migrated over to Feedly's API now that Google Reader is out.

In addition to its Web-based service, Feedly offers a dynamic Android application that’s easy to use. Swiping over from the left will display the list of RSS feeds you've subscribed to, while swiping over from the right will take you to a menu screen of pre-determined categories like technology, gaming, fashion, sports, and even YouTube, which displays a listing of channels you might want to follow. You can search from this menu page.

Of course, you can also import your Google Reader list to get things started immediately, then hit "Today" to see what’s been trending since you've been hard at work. Feedly describes this functionality as “the perfect five-minute snack: a mix of your must-reads and the most popular articles in your Feedly.” For me, Feedly showcased the headlines from each of my folders first, and then listed everything else that wasn't categorized. Or if you’d rather just view a dump of your entire RSS collection, hit “All” to do so. Overall, Feedly has the nicest design of the bunch.

FeedMe, Free

FeedMe also uses Feedly’s Reader client application, and although it refers to itself as an “unofficial Feedly Reader client application,” the two apps are not alike.

FeedMe is a simple, no-frills reader that displays all of your feeds in one page. But what it lacks in features it makes up for with its breadth of settings options, like the ability to clear the cache, set up sync intervals, and set up the number of unread items to be synced locally (you know, in case you’re heading up into the clouds on a quick plane ride and want something to read on the way there). You can select a theme, choose how many days to keep read items in the list, and choose how many starred items to sync up into the cloud.

As an added bonus, you can select whether or not you want to open links externally in a browser, in Pocket or Instapaper to save for later, or in another app entirely.

gReader, Free

 

It’s going to sound like an echo in here, but gReader also uses Feedly’s cloud. It reminds us a lot of Google Reader, but that’s mostly because it uses the same general iconography. Annoyingly, you’ll have to use a button to view your feed listing (we really like the way Feedly has implemented the listing with just the slide-over gesture), but you can sort by read and unread, or switch between item list view or grid view. gReader lets you subscribe and listen to podcasts within the application—it even features a separate "podcasts" category for easy access. You can even upgrade to the Pro version if you want to get rid of those ads.

Reader+, $1.99

Reader+ (née HD) has been especially praised for its tablet interface, so I tried this one out on a Nexus 7. You can choose to sync your account with either Ridly or Feedly; I chose the latter, since I was already set up that way. Overall, Reader+ reminds me of an RSS-friendly version of Amazon’s Kindle because of its varying reading modes. You can display your feeds by newest or oldest first, and then mark them all as read so that nothing old stays behind. Like FeedMe, Reader+ also features a plethora of settings options, including the ability to scroll through your feeds with the volume rocker as a navigational button and the ability to enable Text to Speech. Additionally, you can listen to podcasts you subscribe to from within the application.

RSS Demon, Free

RSS Demon is the most straightforward of them all—a simple, clean RSS and podcast reader. The app supports RSS, ATOM, and podcast feeds, including the ability to download podcasts for offline listening. You can import from OPML, which will come in handy if that’s the way you’ve chosen to export your Google Reader. If you’re the kind of person that needs to keep privy to everything at all times, you can set up notifications to be alerted every time a new story posts. And if you’re the type that feels like being secretive, you can set up password-protected feeds. There's also an "Elite" license that removes ads.

Listing image by Leonski

View the original article here

Review: The HTC One Google Play edition offers the best of both worlds

Enlarge / Google's HTC One strips away Sense in favor of stock Android, Nexus-style.

So far, 2013 has brought with it a number of changes to Google's Android strategy. More and more apps and services are being separated from the core of the operating system to allow for easier updating. Google didn't take advantage of Google I/O to announce a new version of Android, and what we've seen of the rumored version 4.3 suggests that it will be a relatively minor update. And Google is working with its partners to sell versions of their high-end smartphones that run stock Android instead of those partners' respective Android skins.

The roster of so-called Google Play-edition phones doesn't replace Google's tailor-made Nexus products, but it does augment them—if you don't like the design of the Nexus 4 or its lack of LTE, these handsets are intended to give you the stock Android experience running on the best hardware anyone is making today. Samsung's Galaxy S 4 and the HTC One are the first two phones on offer, and we'll look at the One here.

Whether you prefer the stock Android experience to HTC's Sense and its add-ons is largely a matter of taste, but there are some things about the Google Play edition of the phone that are objectively better, worse, and just plain different from the standard edition. It is to these aspects of the phone that we'll be paying the most attention. For more on the standard edition of the One, our review of it is here; more detailed information on Android 4.2 is here.

Enlarge / The AT&T logo on the back is the only thing that differentiates the standard One from the Google Play edition.Specs at a glance: HTC One Google Play editionScreen1920×1080 4.7-inch (468 PPI) Super LCD 3 with RGB MatrixCPUQuad-core 1.7GHz Qualcomm Snapdragon 600Networking802.11a/b/g/n/ac, Bluetooth 4.0, NFCCamera4MP rear camera with "UltraPixel" image sensor, 2.1MP front cameraSize5.41" × 2.69" × 0.37" (137.4 × 68.2 × 9.3 mm)SensorAccelerometer, gyroscope, digital compass, proximity sensor, ambient light sensor

The phone's shell is nearly identical to the subsidized, locked versions of the One you can go out and buy from your carrier. The only external difference between the two phones is the AT&T logo etched onto the back of the standard One.

Otherwise, this is the same handsome aluminum body and 1080p IPS touchscreen that we saw in our One review earlier this year. Whether you prefer to hold the One, the Nexus 4, or the Galaxy S 4 in your hand will depend on which material you prefer—metal, glass, or plastic—but we can say that the One remains one of the nicest Android phones on the market right now. It feels rock solid in your hand, and unlike the glass-backed Nexus 4, the One shouldn't be as prone to scratches and scuffs.

If you're coming from any other phone, the one thing that might take a little getting used to is the way the One's edges are angled inward slightly toward the display. Most other phones and handheld devices that come through our offices—the Galaxies, iPhones, BlackBerries, and so on—have flat edges, and the first day or so I spent with the One the phone felt just ever-so-slightly off. You get used to it (and to the phone's height—it's slightly taller than either the Galaxy S 4 or the Nexus 4) in short order, but it's really the only thing I can think to take issue with. Otherwise, the One still feels excellent, regardless of the software it's running.

Enlarge / Combine the HTC One and the Nexus 4 and you might just have one of our favorite Android phones.

These phones' main draw is their promise of stock, up-to-date Android, and on that front the Google Play edition of the One delivers. All of the standard One's splash screens have been replaced by the same understated Google logo as is found on the Nexus, plus a boot animation specific to Google Play Edition phones (it trades the Nexus' glowing, multi-colored X for multi-colored circles that swirl around each other in an X-shaped pattern).

If anything, the version of Android 4.2.2 on the HTC One looks even more "stock" than the Google Play edition of the Galaxy S 4, which changes the lock screen a bit to accommodate flip covers and gets rid of some gradients throughout the OS to better take advantage of that phone's AMOLED display (since AMOLED pixels display black by shutting all the way off, a black background consumes a tiny bit less power than a dark background with a gradient).

Enlarge / The Google Play Edition of the One lacks the onscreen software buttons of the Nexus 4. Double tapping the capacitive home button invokes the application switcher.

There are two big visible changes compared to the Nexus 4 Android experience: the first, obviously, is that the onscreen software buttons (part of the Android design spec for phones since version 4.0) are absent in favor of the One's capacitive home and back buttons. This frees up a few extra pixels on the One's screen unless an app calls for the legacy Android Settings button, which shows up at the bottom as it does on the standard One. The second is that a Beats Audio toggle has been added to the sound settings. When using the phone's built-in speakers the setting makes a positive difference, and on the stock One the Beats optimizations make the highs a bit less tinny and the lows a bit more bass-y than in the standard version.

Otherwise, the experience of actually using the Google Play edition One is identical to using the Nexus 4. Things are a little different under the hood, though—where Google manages both the operating system kernel and the UI on the "true" Nexus devices, it controls only the UI in the Google Play edition devices. This leaves the kernel itself in the hands of the OEMs, who will need to update it with their drivers and optimizations every time an Android update is issued. As we mentioned last week, this probably means that the Google Play edition phones won't receive their updates as quickly as the proper Nexus devices; however, without having to update their own custom skins and deal with carrier meddling testing, the updates should still come to the Play edition phones more quickly than the standard versions.

View the original article here

BlackBerry backtracks, won’t release BB10 PlayBook update after all

Sign up for the Ars Technica Dispatch, which delivers links to the most popular articles, journals, and multimedia features via e-mail to your inbox every week.

I understand and agree that registration on or use of this site constitutes agreement to its User Agreement and Privacy Policy.

View the original article here

Apple’s back-to-school promo is back, gives you more to spend on Apple

Sign up for the Ars Technica Dispatch, which delivers links to the most popular articles, journals, and multimedia features via e-mail to your inbox every week.

I understand and agree that registration on or use of this site constitutes agreement to its User Agreement and Privacy Policy.

View the original article here

Man creates “invisible headphones” by implanting magnets into his ears

A man has implanted magnets into his ears to use as invisible headphones in a remarkable example of DIY transhumanism.

Rich Lee, a self-described transhumanist and body modification fan (or "grinder"), was inspired by a similar idea posted on the Instructables site that featured two small in-ear magnets stimulated with a magnetic coil necklace connected to an amplifier (you can see the video with this piece). The difference is that Lee actually implanted his inside his fleshy lobes.

The coil necklace is completely hidden by his clothing, and the scars from the implants are also unnoticeable. It's unlikely you'd realize that as he was standing in front of you he could be listening to music. In a way it's reminiscent of the bone vibration Google Glass uses instead of conventional earphones.

There are other uses, too, he writes in h+ magazine: "Listening to music is nice and probably the most obvious answer, but I intend to do some very creative things with it. I can see myself using it with the GPS on my smartphone to navigate city streets on foot. I plan to hook it up to a directional mic of some sort (possibly disguised as a shirt button or something) so I can hear conversations across a room. Having a mic hooked up to it and routed through my phone would be handy."

Make your own invisible earphones

"You could use a simple voice stress analysis app to detect when people might be lying to you. Not to say that is a hard science, but I'm sure it could come in handy at the poker table or to pre-screen business clients. I have a contact mic that allows you to hear through walls. That might be my next implant actually."

He also plans to give himself a kind of bat-like echolocation ability by rigging it up to an ultrasonic range finder—as objects get closer, the in-ear hum builds, and as they move away it gets quieter. This makes a lot of sense for Lee, because he knows he will soon become legally blind.

"I'd love to hook a Geiger counter up to it and experience the world of radiation," he writes. "Living near the old Nevada nuclear testing grounds provides a lot of opportunity for this. I wouldn't mind finding some yellow cake uranium while on a hike because that stuff is expensive. Hearing a gentle hiss around warm objects might be a novel way to experience the thermal realm. The implant is going to allow for a lot of new senses."

It's still very much untested though, and the sounds he experiences are altered by other factors (like if he's got his finger in his ear or not). It is also incredibly important that he doesn't walk near any unexpectedly powerful magnets.

This story originally appeared on Wired UK.

Listing image by Mario's Planet

View the original article here

It’s not all code: A walk-through of goodies from Microsoft Build 2013

This week, you've joined us for the liveblogs and heard the many different announcements from Microsoft's Build developer conference. We got an extensive hands-on look at the new features in Windows 8.1 and its many interface changes. We also touched on Windows' new out-of-the-box 3D printing capabilities and took a stroll through the vastly improved Windows Store. After all that, we perused the miniature show floor, which was mostly a showcase of some of the latest Windows products. Take a peek.

Build had a show floor with all sorts of the latest hardware running Microsoft software.

Build had a show floor with all sorts of the latest hardware running Microsoft software.

It seems that this year's Build was the year of the 3D printer. These devices were sprinkled all over the show floor, though it isn't surprising considering Microsoft's push for out-of-the-box compatibility in Windows 8.1.

We still can't help but marvel at the things 3D printers are capable of printing.

A closer look at the fluorescent-colored HTC 8S, one of the Windows Phone 8 phones that is not expected to make it to the US alongside HTC's flagship 8X.

It's a nicely built phone, however, and it felt comfortable to hold. Frankly, it made us miss the smaller form-factor of the handsets from the days of yore.

This is the Lumia 925. Its OLED screen is low-power, which is why the handset can tell time even if the screen is off.

A look at the backside of the Lumia 925.

It features aluminum trim all around the edges.

OEMs are still attempting to figure out the right form factor for touch-enabled Windows devices. It remains to be seen if hybrid tablet / laptop devices are the right setup.

The Acer Iconia W3. While Windows 8 wasn't exactly designed for the size of a tablet, Windows 8.1 features some improvements to the Start screen and applications that should help offer a better experience for portrait-oriented devices.

This is a giant tablet-like device from Lenovo.

We haven't had a chance to use a Lenovo ThinkPad Helix just yet, but we did get a demo of it at Build. Here is the keyboard dock for the laptop-tablet hybrid device.

When the tablet portion of the device is plugged in, it looks just like a regular laptop.

The Helix that we got to see was a bit worn, but you can check out the flat-top keyboard.

Ars Technica

Testing out pressure sensitivity on a tablet at Microsoft's BUILD conference.

This is the great wall of phones at the Nokia booth. There are 200 Nokia Lumia 825 devices here that could be controlled remotely. The Maps functionality was especially neat to see in real time.

Attendees were encourage to participate in the scavenger hunt for nine different buttons placed throughout the Moscone Convention Center. Each button depicted one of the many touch actions you can perform on the touch-enabled Windows devices.

The Xbox One was one of the first pieces of hardware on display.

Unfortunately, it was enclosed in a plastic box. There was even a security guard watching over the unit.

That plastic enclosure makes taking photos kind of tough.

A side look at the Xbox One's Kinect.

A closer look at the Xbox One's controller.

Expand full story

Florence Ion / Florence is the Reviews Editor at Ars, with a focus on Android, gadgets, and essential gear. She received a degree in journalism from San Francisco State University and lives in the Bay Area.

@Ohthatflo!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="//platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");

View the original article here

Apple files trademark for “iWatch” moniker in Japan

Sign up for the Ars Technica Dispatch, which delivers links to the most popular articles, journals, and multimedia features via e-mail to your inbox every week.

I understand and agree that registration on or use of this site constitutes agreement to its User Agreement and Privacy Policy.

View the original article here

Black HTC One mini leaks reveal very minor design differences

Sign up for the Ars Technica Dispatch, which delivers links to the most popular articles, journals, and multimedia features via e-mail to your inbox every week.

I understand and agree that registration on or use of this site constitutes agreement to its User Agreement and Privacy Policy.

View the original article here

Android 4.3 teardown reveals small, blink-and-you’ll-miss-them changes

Sign up for the Ars Technica Dispatch, which delivers links to the most popular articles, journals, and multimedia features via e-mail to your inbox every week.

I understand and agree that registration on or use of this site constitutes agreement to its User Agreement and Privacy Policy.

View the original article here

HTC pulls the plug on promised Android 4.2 update for a year-old phone

Sign up for the Ars Technica Dispatch, which delivers links to the most popular articles, journals, and multimedia features via e-mail to your inbox every week.

I understand and agree that registration on or use of this site constitutes agreement to its User Agreement and Privacy Policy.

View the original article here

Experience ancient forensic science in Antonio Garrido’s The Corpse Reader

Crime novels complement summer the same way that horror novels complement autumn and Halloween. They just go well together. But there are pitfalls in the crime genre. It returns to the same settings all too often; its characters tend to adhere to clichés. As we head out to the back porch, the beach, or the mountains for summer vacation, how many times do we have to revisit the traditional noir detective setting in a metropolis like LA or Chicago? How many hard-nosed detectives do we really need? Maybe it’s time for something new.

This summer, I got my claws hooked into Antonio Garrido’s police procedural The Corpse Reader. For Arsians who prefer a more historical look at the science of forensics, this novel offers that glimpse into history while keeping our thirst for mystery and suspense satisfied.

The Corpse Reader tells the story of Ci Song, a humble scholar during the thirteenth century Tsong Dynasty in China. Song has to give up his academic studies when his grandfather dies. He finds work as a gravedigger, and it’s squarely in the realm of dead bodies where he sharpens his skills at “reading” a corpse for signs of decay in order to identify time and form of death.

Song is able to prove himself thanks to his intellect and skill, and the Imperial Court eventually asks him to investigate grisly murders and mutilations that are terrorizing the court and the authorities. Ci Song, by the way, is based on an actual historical figure known as Sung Tz’u, who wrote a guidebook for coroners called Washing Away of Wrongs. Garrido teases out the story behind Tz’u's book, leaning heavily on the principle that a forensic official’s duty is carried out in the everyday practice of looking at a body up close.

It’s exactly in these everyday procedures, described in The Corpse Reader, that we see how forensics got its start. Today, DNA evidence, computer records, and the latest advances in technology have augmented what we can learn from a dead body. But in this story, we get to experience the intrigue up close and learn about the cultural attitudes that the ancient Chinese had about the body and biology. Some of the descriptions in the book will leave you never seeing flies the same way.

It should be noted that this particular translation (done by Tom Burnstead from Garrido’s Spanish prose) favors simplicity—perhaps too much simplicity. Some readers may find it takes a few chapters to get into the groove. Once the mysteries of the murders deepen, though, the book’s plot is impossible to let go of.

Garrido spoke to Ars from Spain about the process of writing The Corpse Reader and how he was able to find the perspective of a people living eight centuries ago.

“You have to find an equilibrium [in the storytelling],” Garrido said. “Some of what we know of Chinese attitudes from the thirteenth century may at first seem illogical and surprising but only from our point of view. For example, some of the punishments dealt out to citizens would be considered brutal by our standards today, but people in that time period endured them. But that's because there was a strong belief in punishing criminals.”

Song is able to rise in status in the novel thanks to his intellectual and civic accomplishments, and Garrido notes that this was true at that time for much of the Chinese population.

“If a person performed extremely well in their exams, any person could rise up to high levels, such as minister,” Garrido said. “In the thirteenth century, everyone knew how to read and write. There was system of reward and punishment... so people that broke laws, they lost points. The ones that behaved well were rewarded. There was an incentive to follow the law."

Song proves to be a character who really diverts from the usual patterns of crime novel protagonist. He is bound by his obligations to his family and his society, and he has real vulnerabilities as a person. Even as we see him grow in power and expertise, he remains tangible and human.

The Corpse Reader is a refreshing break from the urban-noir fetish that is so common in conventional thrillers and crime books. It’s a great novel to add to a summer reading list. Just keep the bug spray handy, because the notion of bugs buzzing around you is going to make you sick to your stomach from now on.

View the original article here

An HP smartphone is in the works, says director

Sign up for the Ars Technica Dispatch, which delivers links to the most popular articles, journals, and multimedia features via e-mail to your inbox every week.

I understand and agree that registration on or use of this site constitutes agreement to its User Agreement and Privacy Policy.

View the original article here

Here’s what Android 4.3 might look like on a Galaxy S 4

Sign up for the Ars Technica Dispatch, which delivers links to the most popular articles, journals, and multimedia features via e-mail to your inbox every week.

I understand and agree that registration on or use of this site constitutes agreement to its User Agreement and Privacy Policy.

View the original article here

Tuesday Dealmaster has a quick 256GB Samsung 840 Pro on sale

Sign up for the Ars Technica Dispatch, which delivers links to the most popular articles, journals, and multimedia features via e-mail to your inbox every week.

I understand and agree that registration on or use of this site constitutes agreement to its User Agreement and Privacy Policy.

View the original article here

Android flaw allows hackers to surreptitiously modify apps

Enlarge / A screenshot of an Android device that's been hacked by modifying the device manufacturer's application. The hack gives access to all permissions on the device.

Researchers said they've uncovered a security vulnerability that could allow attackers to take full control of smartphones running Google's Android mobile operating system.

The weakness involves the way legitimate Android applications are cryptographically signed to ensure they haven't been modified by parties other than the trusted developer, according to a blog post published Wednesday by researchers from mobile security startup Bluebox. The flaw has existed since at least the release of Android 1.6 almost four years ago. Hackers who exploit the vulnerability can modify app code to include backdoors, keyloggers, or other malicious functionality without changing the verification signature.

Malicious apps that exploit the vulnerability would enjoy the same system privileges as the legitimate one. That access could be especially dangerous if the app that's modified originated with the handset manufacturer or third parties that partner with the manufacturer, Wednesday's blog post said. That's because such apps are typically granted elevated privileges within the Android OS.

"The application then not only has the ability to read arbitrary application data on the device (e-mail, SMS messages, documents, etc.), [and] retrieve all stored account & service passwords, it can essentially take over the normal functioning of the phone and control any function thereof (make arbitrary phone calls, send arbitrary SMS messages, turn on the camera, and record calls)," the blog post said. "Finally, and most unsettling, is the potential for a hacker to take advantage of the always-on, always-connected, and always-moving (therefore hard-to-detect) nature of these “zombie” mobile devices to create a botnet."

While it would be devastating if an attacker was able to get such a modified APK into the Google Play Store, or somehow use the technique to hijack the update mechanism of legitimate apps, there are probably safeguards already in place to prevent such attacks.

"I imagine that Google would move quickly to add some logic to look for such attacks," Dan Wallach, a professor specializing in Android security in the computer science department of Rice University, told Ars. "Without that available to an attacker, this is likely to only be relevant for Android users who use third-party app stores (which have lots of other problems). This bug could also be valuable for users trying to 'root' their phones."

Blue box researchers privately reported the vulnerability to Google in February.

View the original article here

Review: The Hisense Sero 7 Pro is a Nexus 7 clone for $50 less

The Hisense Sero 7 Pro (left) and the Nexus 7 (right): peas in a pod.

A few weeks ago we reviewed Hisense’s Sero 7 Lite, a new budget Android tablet that isn’t very good until you consider that it costs $99. The tablet that Hisense really wants you to see, though, is the $149 Sero 7 Pro. This tablet runs a quad-core Nvidia Tegra 3 SoC. It comes with a 1280×800 7-inch screen, 1GB of RAM, and Android 4.2. If these specs sound familiar to you, it’s probably because they’re identical to what's in the Nexus 7 tablet that Google and Asus will sell you for $199.

Using the Sero 7 Pro is very similar to using the Nexus 7 with Android 4.2 installed, so for this review we’ll be focusing on a side-by-side comparison with the tablet that Google has been selling for about a year now. If you’re buying a 7-inch Android tablet today, should you stick with the Nexus or save yourself the $50?

Enlarge / The Nexus and the Sero 7 Pro are roughly the same size and weight and have an identical button layout.Specs at a glance: Hisense Sero 7 ProScreen1280×800 7" (216 ppi) IPS touchscreenCPU1.2GHz Nvidia Tegra 3 (1.3GHz in single-core mode)Storage8GB NAND flash (expandable via microSD)Networking802.11a/b/g/n, Bluetooth 3.0, NFC, GPSPortsMicro USB, mini HDMI, headphones, microSD cardSize7.87" × 4.95" × 0.43" (199.9 x 125.7 x 10.9 mm)Other perks2MP front camera, 5MP rear camera, power adapter

The screen, the SoC, and the RAM are probably the three biggest hardware components that will affect your tablet experience, and the Nexus 7 and the Sero 7 Pro share them all: a five-point 1280×800 IPS touchscreen, a quad-core Tegra 3 SoC that can run at up to 1.3GHz, and 1GB of RAM. The Sero 7 also includes the same 8GB of internal storage as the original entry-level Nexus 7, but Google's more recent $199 model has since been bumped to 16GB of storage.

The Sero's screen looks slightly warmer than the Nexus' to our eyes, but otherwise they share most of the same properties: good viewing angles, good (but not amazing) colors and pixel density, and a tendency to ghost somewhat when used after a few hours of disuse. Our review unit also had some very slight light bleeding around the edge (and a single stuck pixel) that the Nexus 7 didn't have. It's not distracting in normal use, but it's the sort of quality control issue you can expect to see from tablets in this price range. It looks as though the distance between the top glass and the actual screen is a bit larger than it is in the Nexus, which makes colors and text pop just a bit less (you can sort of see this effect in action in the side-by-side shots—the blacks in particular look blacker on the Nexus).

Where the Sero 7 Lite was pretty barebones in its networking capabilities, the Sero 7 Pro actually edges out the Nexus 7. The Sero has a GPS, Bluetooth, and NFC just like the Nexus, but it also includes 5GHz 802.11n where the Nexus is limited to the 2.4GHz band.

Enlarge / The Sero runs Android 4.2.1, just a bit out-of-date compared to Android 4.2.2.

Moving on from the hardware, both tablets also run Android 4.2, though the Sero 7 Pro runs version 4.2.1 instead of 4.2.2. Aside from some Walmart-specific preloaded applications and some changes in the settings to accommodate hardware features that the Nexus doesn't have, the interface is almost entirely stock. There’s a software screenshot button at the bottom of the screen and a panel in the settings that controls HDMI output, but otherwise the differences between the Nexus 7 and the Sero are inconsequential. The Sero runs about as well as does a Nexus 7 running Android 4.2, generally smooth but punctuated by periods of choppiness (probably related to the storage speeds, as we'll talk more about later on).

Finally, the Sero 7 Pro’s acceptable specs combined with its low price have made it a prime target for the hacking community. There are already resources available on the XDA Developers forums if you’re looking to make this tablet do stuff that it shouldn’t be able to do.

Enlarge / Both tablets have rubberized plastic backs, but the Nexus (right) is the better-looking tablet in our opinion.

Obviously the visual design of the Walmart-exclusive Sero 7 Pro differs from the Nexus 7, though they share some of the same design ideas. The back of the Sero is a brownish, rubberized plastic with a rough texture that makes it easier to grip. The Nexus has a similarly rubberized, textured back, but the effect is less pronounced. To our eyes, the bumpy brown of the Sero isn’t as attractive as the understated black-and-silver of the Nexus.

The glass coating the Sero's screen feels similar to the glass on the Sero 7 Lite's, which is to say that it appears to lack the fingerprint-resistant oleophobic coating that the Nexus and most other touch devices have these days. This adds to the resistance you feel when you drag your finger across the screen, and it makes fingerprints and smudges much more difficult to clean. The bezels are shaped and sized similarly, though, and the tablet's front-facing camera is still the kind of thing you'd only ever want to use for short video chats.

Enlarge / The Sero has a 5MP rear-facing camera and LED flash that the Nexus lacks. Enlarge / It also has a mini HDMI port and a microSD card slot, both missing from the Nexus. Enlarge / Finally, twin rear-facing stereo speakers up the volume and quality very slightly from the Nexus 7's speaker. Enlarge / The Sero also has some quality control issues that we don't see in our Nexus 7. There's some backlight bleeding around the edge of the screen, shown here, as well as a single stuck pixel.

The Sero also has a rear-facing camera with LED flash and two rear-facing speakers on either corner, where the Nexus has no rear camera at all and two speakers set more closely together behind a single grille. Since they're still tablet speakers and they're still on the back of the device, they don't produce sound you'd write home about. Still, they're a small step up in quality and volume. The pictures are surprisingly not terrible if you have enough light—they're certainly not great, but if you're outside and the Sero is the only camera you've got with you, it's not the worst thing we've ever seen. It supports the standard Android 4.2 camera features, including Photo Sphere and panoramic shooting.

Enlarge / An indoor snapshot from the Sero. A bit noisy and blurry, but the colors are OK at least. Enlarge / The same picture from the Nexus 4. The quality is pretty similar, though the Nexus has a higher megapixel count.

The Sero even adds some useful port options that the Nexus doesn't have, including a microSD card slot for storage expansion (which helps to offset the 8GB of internal storage) and a mini HDMI port for playing video and photo content on your TV or monitor. None of these are what I would consider killer features, but they're some nice value-adds over what the year-old Nexus 7 offers.

Expand full story

Page: 1 2 Next ?

Andrew Cunningham / Andrew has a B.A. in Classics from Kenyon College and has over five years of experience in IT. His work has appeared on Charge Shot!!! and AnandTech.

@AndrewWrites!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="//platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");

View the original article here