Canonical Joins Document Foundation Advisory Board

Canonical, the parent company of Ubuntu, has joined the advisory board of The Document Foundation (TDF). TDF is the organization that manages and develops the free and open source office suite LibreOffice.

"We are extremely pleased to become a member of the LibreOffice Project Advisory Board and having the opportunity to provide our guidance and insights to help improve LibreOffice for users around the world," said Will Cooke, Desktop Engineering Manager for Canonical.

The Advisory Board represents the sponsors of TDF and offers advice, guidance, and proposals to the Board of Directors.

LibreOffice has been the default office suite on Ubuntu since its early days. The upcoming release of LibreOffice 5.2 will be one of the first applications to be available through the Canonical-sponsored Snappy package management system.

Telegram Accounts Hacked in Iran

The messaging service Telegram has come under fire again. This time, accounts of dozens of Iranian Telegram users have been compromised. Hackers were also able to access more than 15 million phone numbers and accounts exploiting the API of the service.

Independent researchers Claudio Guarnieri and Collin Anderson discovered that the Telegram breach in Iran was conducted through SMS messages. Telegram uses SMS messages to send a verification code when a new device is set up. Hackers gained access to a target's SMS message and then obtained code to add their device to the target's account. Once the device was added to the account, they gained complete access to that account, including the chat history.

According to various reports, Rocket Kitten, an Iranian hacking group, is behind this breach. Researchers also hinted at the involvement of the Iranian government and cellular companies, because the service is heavily used by activists, journalists, and citizens who want to bypass the government's control. Iran has more than 20 million Telegram users.

Telegram downplayed this hack and told users to "stay calm and Telegram." In a blog post, the company confirmed the hack: "Certain people checked whether some Iranian numbers were registered on Telegram and were able to confirm this for 15 million accounts. As a result, only publicly available data was collected and the accounts themselves were not accessed. Such mass checks are no longer possible since we introduced some limitations into our API this year. However, since Telegram is based on phone contacts, any party can potentially check whether a phone number is registered in the system. This is also true for any other contact-based messaging app (WhatsApp, Messenger, etc.)."

The company also reminded users to use two-factor authentication instead of SMS verification. SMS verification is not trustworthy, and if you rely on end-to-end encryption of your messaging, this breach is a reminder to be aware of other factors, such as SMS authentication, that can compromise your account.

This is not the first time Telegram has been under fire. Last year, security researchers pointed out many security issues affecting the service.

Jeep Cherokee Hacked Again

Two cybersecurity researchers Charlie Miller and Chris Valasek, who hacked Jeep Cherokee last year, have demonstrated yet another hack of the vehicle, taking almost complete control of the car. Unlike their previous hack, which was executed remotely, the new hack requires physical access to the car.

Miller and Valasek plugged in their laptops to the OBD (the diagnostic port of the car) and gained control of almost every feature that can be controlled via computer. Once they were connected to the car, they updated the firmware for ECU (electronic control unit) and enabled certain features that were disabled for security reasons. This allowed them to take control of the steering wheel, even when the car was not in reverse mode or if it was driven at any speed. They were also able to apply the parking brake and change cruise control settings.

In a statement to Wired, Fiat Chrysler (FCA) said, "While we admire their creativity, it appears that the researchers have not identified any new remote way to compromise a 2014 Jeep Cherokee or other FCA US vehicles."

Although this hack did require physical access to the car, it does demonstrate a potential for hacking cars through the OBD dongles that are offered by insurance companies. It also demonstrates that eventually someone may find a remote hack to gain access to these controls.

FCA further added, "It is highly unlikely that this exploit could be possible … if the vehicle software were still at the latest level." Miller and Valasek disputed the company's claim and stated this hack has nothing to do with the infotainment system that was patched by the company.

Miller and Valasek shared the findings of their research at the Black Hat security conference on August 3-4.

Miller and Valasek entered the limelight a year ago when they remotely hacked a Jeep Cherokee. The duo was able to disable the transmission and brakes of the car while it was driven by a Wired reporter on the road. They were also able to take control of the steering wheel while the car was in reverse or parallel parking mode. Post hack, the duo was hired to work at Uber's Advanced Technology Center in Pittsburgh.