category — gadgets

ls ./category/gadgets

Gadgets

Hardware, firmware and the devices worth trusting.

22 articles

Android can now move your passkeys between password managers. Whether it asks for your fingerprint is up to the app you leave

2026-09-15

Google has switched on direct transfers of passwords and passkeys between password managers on Android, built on the FIDO Credential Exchange Format and live in Google Password Manager, 1Password, Bitwarden and Dashlane. Apple describes its version as secured by Face ID. Android's developer guide leaves the biometric prompt to the exporting app, and its sample code marks it optional.

The Apple Watch now listens all day, and the consent is a chime on somebody else's wrist

2026-09-12

Siri Recap and Live Rewind keep the microphone live. Apple says no audio is stored — only condensed text sent to Private Cloud Compute, deleted after seven days. Every safeguard is built around the wearer. California's recording statute asks about the consent of everyone else in the room.

The fake reward apps moved to the one Play Store shelf where nobody can leave a public review

2026-09-12

Bitdefender found thousands of apps in Google Play's Early Access program — fake casino, reward and cash-out games promoted with deepfake celebrity ads. Early Access exists so unfinished apps are not judged too soon, which means only the developer sees feedback. For an app that never intends to launch, that shield never comes down.

Apple came last on repairability, and the grades moved because the ruler changed

2026-09-10

Motorola B+, Google C-, Samsung D, Apple D-. The scores come from PIRG's fifth Failing the Fix report, across 105 phones — and the reason they look different from previous years is that the scoring switched to the EU's EPREL criteria, which weight disassembly properly.

Apple moved the memory off the chip's back, and that is the change that mattered

2026-09-10

The A20 Pro is the first 2-nanometre phone chip, which is the headline. The change that actually unlocks it is duller and bigger: for years the iPhone's DRAM sat stacked on top of the processor, directly in the heat path. This year Apple put it beside the die instead.

Every Duo hinge is fitted to one housing, and a spare part cannot carry the fit

2026-09-10

Apple's hardware chief described a hinge assembled per unit: AI matches each hinge to its best-fit housing, a laser scans that individual body, and photopolymer is printed onto it to cancel that body's measured waviness. EU law puts hinge assemblies on the seven-year spare parts list anyway. Both things are true, and they do not fit together.

Every iPhone went up 100 dollars, including the ones that did not change

2026-09-10

The iPhone 17 is the same phone it was on 8 September and it now costs more than it did at launch. Old models get cheaper when a new generation lands, not dearer — and Apple's own storage ladder, which steepened only at the top, says exactly which component did this.

Your RGB lighting installed a kernel driver — and a Windows update is how you found out

2026-08-24

KB5121003 broke several games with access violation errors and restarts. Microsoft traced it to drivers with filenames like inpoutx64, installed by peripherals and internal components with RGB lighting. The workaround being shared is to delete a service and remove the file from the Windows drivers folder.

The malware reaches the car through the update channel the car trusts

2026-08-22

Kaspersky found previously unknown malware on Android head units running DoFun, delivered through the legitimate update mechanism of a system app over an MQTT broker. It checks in every 90 minutes, runs ad fraud, and is attributed with high confidence to the group behind the BADBOX botnet.

The camera-hacking crew left 407 MB of their own working directory on the internet, shell history included

2026-08-20

Hunt.io reconstructed Operation CameraSwarm from the operator's own exposed files: 2,616 of them across 234 folders, with tooling, logs and command history. The campaign took more than 14,530 Dahua devices in 35 days using password guessing, two authentication bypasses and a peer-to-peer relay — concentrated in Ukraine and Russia.

Your router can already tell when someone walks past it — Comcast now offers that as a feature

2026-08-20

Xfinity WiFi Motion turns the radio link between your gateway and a smart speaker into a movement sensor, with no camera and no hardware to buy. It is opt-in and off by default, which most of the alarm about it gets wrong. The real question is what a log of when your home was occupied becomes once your ISP is holding it.

A CVSS 9.8 in macOS Screen Sharing let anyone on the network in without a password — and the payload was a crypto miner

2026-08-18

CVE-2026-65400 bypasses credential validation on Apple's remote desktop service. The Dutch NCSC confirmed exploitation against internet-exposed Macs with port 5900 open, and what turned up was root access and a Monero miner.

The scam ends with the victim tapping their own card against their own phone

2026-08-17

Group-IB's WindRelay pairs a reader on the victim's Android with an emulator at the attacker's terminal, relaying EMV commands over WebSocket in real time. SpyNote installs it silently; the victim is talked into the tap.

Apple told users in 110 countries they may have been targeted by mercenary spyware — and named nobody

2026-08-16

The latest round of threat notifications went out on Thursday. Apple has now notified people in over 150 countries since late 2021, and deliberately attributes nothing — which is both a defensible policy and the reason these alerts are hard to act on.

Chrome is blocking 7 billion unwanted Android notifications a day — and rate-limiting the worst sites to 1,000 a minute

2026-08-14

Google published Q1 2026 figures for its notification abuse work: automatic permission revocation for inactive sites, HTTP 429s past a threshold, and network-level analysis of coordinated service workers.

This botnet's DDoS traffic looks like Chrome because it builds a complete browser fingerprint

2026-08-13

Unit 42's analysis of Kimwolf v7 describes HTTP/2 floods that mirror real browser behaviour at the protocol and header level. It runs on Android TV boxes with port 5555 open, and resolves its C2 through Ethereum Name Service.

Plugging in a USB device can still get you SYSTEM on a fully patched Windows 11

2026-08-12

Presented at DEF CON 34, 'Plug And Pwn' chains Windows' own driver auto-install against itself — emulate a Sierra Wireless modem, then a Sony FeliCa reader, and a DLL lands in System32. There is a Remote Desktop variant too.

A SIM card can tell your modem what to do — and on some devices, that means code execution

2026-08-12

Researchers from the University of Birmingham and Fuzzware showed that a hostile SIM can drive a standardised command called RUN AT straight into the modem. Three of eighteen phones accepted it. So did six of eight Quectel modules, and an EV charger.

Six flaws sit in the code that checks whether firmware is genuine — and it has been there since 2013

2026-08-10

Binarly found six vulnerabilities in U-Boot's FIT signature verification. Two allow code execution during verification itself. The code dates to U-Boot 2013.07, and the devices running it mostly update through vendors who may never ship a patch.

A hardware wallet's random number generator wasn't random — and $88.6m left in 41 minutes

2026-08-10

COLDCARD firmware fell back to a deterministic pseudo-random generator seeded from the chip ID and system timing. Researchers say seeds made that way could be reconstructed offline, and the sweep began roughly 30 hours before the flaw was public.

The EU's repair deadline passed on 31 July — and the harder rule lands in February 2027

2026-08-09

Member states had until the end of July to implement the Right to Repair directive. The bigger change comes in 2027, when phones, tablets, earbuds and laptops sold in the EU must let users swap the battery with ordinary tools.

Your next phone won't get more RAM — the memory went to AI data centres

2026-08-09

DRAM contract prices nearly doubled in a quarter as Samsung, SK Hynix and Micron moved capacity to the stacked memory that feeds AI accelerators. Device makers are responding with higher prices — and, more quietly, by holding RAM configurations still.