Pokemon Go grants itself "full access" to your Google account

In one of the most bizarre events in recent history Nintendo's new location-based augmented reality game Pokémon GO has been making the news since it launched a few days ago. People are so excited to catch 'em all that Nintendo's market-value has jumped to $7.5 Billion (£5.8 Billion) in just two days – the highest surge since 1983.

Due to the huge interest surrounding Pokémon GO, even hackers are using the game's popularity to distribute malicious versions of Pokémon GO that could install DroidJack malware on Android phones, allowing them to compromise user's devices completely. Now I have watched the videos of grown men running around with this game and I must say this might just be the end for society. If you do actually care this app also comes with a huge privacy concern that if your not to busy trying to catch imaginary Pokemon then you should take a break and fix it. The latest threat is related to the privacy concerns raised about the iOS version of the official Pokémon GO app.

According to an article via The Hackers News: Adam Reeve labeled the game "malware," saying that Pokémon GO is a "huge security risk" as the game, for some reason, grants itself "full account access" to your Google account when you sign into the app via Google on iPhone or iPad.

Any app, according to Google's own support page, that granted Full account access, can:

"See and modify nearly all information in your Google Account (but it can't change your password, delete your account, or pay with Google Wallet on your behalf)."

What exactly this means is quite unclear, but Reeve claimed that the Nintendo's Pokémon GO – developed by Niantic – can now:

• Read all your email.
• Send email on your behalf.
• Access your Google Drive documents (including deleting them).
• Look at your search history as well as Maps navigation history.
• Access your private photos stored in Google Photos.
• And a whole lot more.

Although Reeve, who reported the issue on his Tumblr blog, said this issue appears to mostly affect iOS users, some Android users are reporting that their devices are also being affected.

If you want to fix this there are two things that you can do:
 

1. Head onto your Google account permission page and look for Pokémon GO.
2. Select Pokémon GO Release and click "REMOVE" button to revoke full account access.
3. Launch Pokémon GO on your device and confirm it still works.

This will immediately revoke the Pokémon GO app's access to your Google account, but the downside is that users may lose their game data.

The second and simplest approach is to use a burner Google account. For this, create an all new Google account, with nothing in it, and use this account to sign into Pokémon GO as well as other apps that you may find doubtful.  

Hackers can use smart watch motion sensors to steal your ATM pin

As you constantly add the latest gadgets to your daily life be it fitness trackers, smart watches, timed networked heating, networked toasters etc.. do you ever stop to think that with such convince also comes risk? Well I can safely tell you that the more connected you become the wider you make the threat surface that is your personal security. A recent study from Binghamton University cites that it may be possible for hackers to obtain your ATM password from your smart watch or fitness tracker.

The risk lies in the motion sensors used by these wearable devices. The sensors also collect information about your hand movements among other data, making it possible for "attackers to reproduce the trajectories" of your hand and "recover secret key entries." 
And just in case you are doubtful the paper, titled "Friend or Foe?: Your Wearable Devices Reveal Your Personal PIN," computer scientists from the Stevens Institute of Technology and Binghamton University used a computer algorithm that can guess your password and PIN with about 80% success rate on the first attempt, and over 90% of the time with 3 tries.

Now I'm not sure about you but an 80-90% success rate within 3 tries seems pretty dam high to me. The paper also goes on to state that their "Backward PIN-Sequence Inference" algorithm can be used to capture anything a person type on any keyboard – from automatic teller machine or ATM keypads to mobile keypads – through infected smartwatches, even if the person makes the slight hand movements while entering PINs. The paper also states that at this time there is no way to avoid such an attack but have made the suggestion that manufacturers add random white noise to there devices in order to disorient patterns that can capture sensitive information.