A billion or more Android devices are vulnerable to hacks that can turn them into spying tools by exploiting more than 400 vulnerabilities in Qualcomm’s Snapdragon chip, researchers reported this week. The vulnerabilities can be exploited when a target downloads a video or other content that’s rendered by the chip. Targets can also be attacked by installing malicious apps that require no permissions at all. From there, attackers can monitor locations and listen to nearby audio in real-time and exfiltrate photos and videos. Exploits also make it possible to render the phone completely unresponsive. Infections can be hidden from the operating system in a way that makes disinfecting difficult. Snapdragon is what’s known as a system on a chip that provides a host of components, such as a CPU and a graphics processor. One of the functions, known as digital signal processing, or DSP, tackles a variety of tasks, including charging abilities and video, audio, augmented reality, and other multimedia functions. Phone makers can also use DSPs to run dedicated apps that enable custom features. “While DSP chips provide a relatively economical solution that allows mobile phones to provide end-users with more functionality and enable innovative features—they do come with a cost,” researchers from security firm Check Point wrote in a brief report of the vulnerabilities they discovered. “These chips introduce new attack surfaces and weak points to these mobile devices. DSP chips are much more vulnerable to risks as they are being managed as ‘Black Boxes’ since it can be very complex for anyone other than their manufacturer to review their design, functionality or code.” Qualcomm has released a fix for the flaws, but so far it hasn’t been incorporated into the Android OS or any Android device that uses Snapdragon, Check Point said. When I asked when Google might add the Qualcomm patches, a company spokesman said to check with Qualcomm. The chipmaker didn’t respond to an email asking. In a statement, Qualcomm officials said: “Regarding the Qualcomm Compute DSP vulnerability disclosed by Check Point, we worked diligently to validate the issue and make appropriate mitigations available to OEMs. We have no evidence it is currently being exploited. We encourage end-users to update their devices as patches become available and to only install applications from trusted locations such as the Google Play Store.” Check Point said that Snapdragon is included in about 40 percent of phones worldwide. With an estimated 3 billion Android devices, that amounts to more than a billion phones. In the US market, Snapdragons are embedded in around 90 percent of devices. More details are posted on OUR FORUM.

Google Play Music has been given the death sentence by Google, and today the company has announced a bit more detail about how its execution will be carried out. The main message from today's blog post is "back up your music now," as Google says it will wipe out all Google Music collections in December 2020. We've known for a while that the shutdown would be sometime in 2020, but for most regions, Google has now narrowed it down to "October." At the time of the streaming shutdown, the app will have been showing shutdown messages for about five months. If a user has somehow missed all of those, two months with no streaming at all will hopefully be enough to get them to research what happened to Google Music. Saving your music collection from deletion is not difficult; just go to music.youtube.com/transfer and click a few buttons to start the YouTube Music transfer process. The process is actually painless, and your Google Music account will continue to work even after the transfer. If you decide you don't want to use YouTube Music, you'll still have access to a ton of download options later, without the looming threat of the Google Music deletion. A copy of your files isn't hard to get, either. The Google Music Manager is a Windows and Mac application that can upload music or download your entire music collection with a few clicks, but as Google said, it will stop working soon. The other option is Google Takeout, which will wrap your entire music collection in a zip file and send you a download link. The processing for this can take hours. Whichever option you choose, make sure you do something before December because, after that, there will be no way to recover your music. Google Play Music has been around since 2011 and let users upload thousands of songs to the Internet, for free, for streaming playback on most other devices. It's been the primary way to play music on the Google Home smart speakers, and it offered music purchases, monthly streaming radio, and podcasts. Google Music has been neglected for years, though, and like the company often does, Google decided to make a second, competing for music streaming service instead of maintaining the first service. That second service is YouTube Music, which is now Google's favored music app. The merger between the two was originally announced in 2018, and now it's finally happening. YouTube Music places an emphasis on music videos, as you can guess from the name, and the app has a more modern design. YouTube Music awkwardly blends together your entire 15-year YouTube activity history with your music collection, tossing any "liked" videos and subscriptions that have been algorithmically been flagged as "music" into your collection, and mixing together your YouTube playlists and Google Music playlists. There is no way to stop this. YouTube Music seems designed to drive up Google's subscription numbers and really only seems useful for people who want to pay the monthly streaming license fee. The app does away with music purchases and won't even let you stream your own music to your Google Home speakers without paying the monthly fee. It's a big downgrade from Google Music, which offered more functionality to people who purchased music. In 2018, Google told Google Music users "nothing will change" regarding YouTube Music's uploaded music functionality, but now that the feature is actually here, that's... not true. For more turn to OUR FORUM.