computer parts

Researchers at Stanford University have developed a lithium-ion battery that shuts down as it begins to overheat, potentially meaning the types of catastrophic fires seen in hoverboards, laptops and airliners could become a thing of the past.

Lithium-ion batteries are used in just about all portable electronics. They're light, can store a lot of energy and are easily recharged, but they are also susceptible to overheating if damaged. A short circuit in the battery often leads to fire.

In the new Stanford battery, researchers employed a polyethylene film that has embedded particles of nickel with nanoscale spikes. They coated the spikes with graphene, a conducting material, so that electricity can flow over the surface.

But when the temperature rises, the film expands, and at about 70 degrees Celsius (160 degrees Fahrenheit) the conducting spikes no longer touch each other, breaking the circuit and causing the battery to shut down.

Stanford University/IDGNS

Once the battery shuts down, a runaway thermal reaction is avoided and the battery cools, eventually bringing the nickel spikes back into contact and allowing the electricity flow to resume.

"We can even tune the temperature higher or lower depending on how many particles we put in or what type of polymer materials we choose," said Zhenan Bao, a professor of chemical engineering at the university and one of the research team.

The research was also carried out by Stanford engineer Yi Cui and postdoctoral scholar Zheng Chen. Details were published on Monday in the journal Nature Energy.

Stanford University/IDGNS

"Compared with previous approaches, our design provides a reliable, fast, reversible strategy that can achieve both high battery performance and improved safety," Cui said in a statement.

The battery is a second job for the nickel-embedded polyethylene material. Bao, the Stanford professor, used the same material in a wearable sensor she developed to measure body temperature.

AT&T is bringing back an unlimited data plan—but not for all wireless subscribers. Starting Tuesday, DirecTV and U-Verse customers will have the opportunity to pay $100 per month for a single line of unlimited data, talk, and text on AT&T’s network. Additional phones will cost $40 per line, and if you add four smartphones you’ll get the fourth line for free after the first two months.

You can add a tablet as well for $40 per month, or you can opt for a $10 monthly charge and limit the tablet to just 1GB of data per month. Overages on the $10 option are a killer, however, as every gigabyte after that will set you back $15.

The story behind the story: The new unlimited plan is AT&T’s attempt to make the most of its DirecTV acquisition that closed in July. The idea is that the company’s TV subscribers will want unlimited data to stream shows from DirecTV or U-Verse while on the go. Video streams are always a killer for data caps, but that goes doubly so when you have LTE devices thirsty for high-definition images. AT&T says the new unlimited offer is just “the first of many integrated video and mobility offers” slated to debut in 2016.

The limits of unlimited

For AT&T, “unlimited data” means you will be able to use up to 22GB of data per line unfettered. After that, AT&T will slow down your traffic “during periods of network congestion.” That’s standard for AT&T’s new throttling policy for unlimited plans that rolled out in September following a fine in July from the Federal Communications Commission. Sprint has a similar limit of 23GB for its $70 unlimited plan before it will start to throttle.

As for AT&T wireless subscribers looking to get a TV package, AT&T is currently offering DirecTV and U-Verse subscriptions starting at $20 per month. The catch is that price is only for the first 12 months and the deal requires a two-year commitment.

That’s a pretty standard cable deal you can find with pretty much any cable company as a new subscriber. If that doesn’t suit your fancy, you may want to wait. AT&T says it plans to “launch a wide-range of new video entertainment options” later in 2016.

Google's Go, considered an up-and-coming language with usage in projects like Docker and Kubernetes, has netted another feather in its cap: a port to IBM's z Systems mainframe platform.

The port was cited on a GitHub list of repositories from the Linux on IBM z Systems Open Source Team. While IBM's mainframes are often viewed as legacy technology from years past, IBM wants to expand the horizons of its big iron systems with Go.

"We ported Go to z Systems as part of our overall effort to expand the platform's open source ecosystem. We continue to look for ways to provide developers new options for taking advantage of the mainframe," said Marcel Mitran, Distinguished Engineer and CTO for IBM LinuxOne, in an email.

Big Blue, however, still is evaluating specific benefits related to Go, Mitran said. The company does expect that its work with the Go community will benefit developers by making it easier to combine software tools they know with the speed, security, and scale offered z Systems and LinuxOne, he said. "Further, collaborating with this community will enable us to introduce new technologies to the platforms that are based on Go in the future."

The Go port was completed in late 2015. It represents a continued effort by IBM to make its mainframes more contemporary; it introduced Linux-only LinuxOne mainframes last summer. IBM's GitHub for z Systems list also includes efforts involving Apache Cassandra and Spark as well as Kubernetes. The open source Go language debuted a little more than six years ago.

Twitter is giving greater visibility to its live streaming app Periscope, with videos appearing directly in users’ feeds.

Those videos will play automatically—though presumably without audio—straight from the timeline view in Twitter’s iOS app. Tapping on the video will open a full screen view of the Periscope stream, including hearts and comments from Periscope users in real time.

Previously, tweets of Periscope streams merely included a link to the separate app. With videos embedded into Twitter, users can tune into live streams even if they haven’t installed Periscope. The Periscope app will still be necessary to comment on streams or host videos, and there’s no word on whether that’ll change in the future.

Periscope embeds are rolling out over the next few days for iOS users. Support for Android and web versions will arrive “as soon as they’re ready,” Periscope says.

Why this matters: The move is sure to boost usage of Periscope, which had 10 million accounts last August and has now hosted more than 100 million live broadcasts. But the auto-playing streams could also increase data usage from the Twitter app. It’s unclear if disabling auto-play videos in Twitter will prevent live streams from rolling, so users may want to keep an eye on how much data the app is using.

Developers of the popular Drupal content management system are working to secure the software's update mechanism after a researcher recently found weaknesses in it.

Last week, researcher Fernando Arnaboldi from security firm IOActive disclosed several issues with the update mechanism in Drupal: the failure of the back-end administration panel to report update errors, a cross-site request forgery (CSRF) flaw that could allow attackers to force admins to repeatedly trigger update checks, and the lack of encryption for update downloads.

The last issue was the most significant one, because it could have allowed attackers who could intercept the traffic between a Drupal-based site and the official Drupal servers, to inject back-doored updates. Such an attack could lead to the compromise of the site and its database.

Fortunately, the Drupal security team was notified in advance and is working to fix the update shortcomings. Over the past few days the team has switched the project's infrastructure to support HTTPS so that the update processes for the Drupal core and its modules use secure channels.

For now the team has enabled HTTPS updates in Drush, a popular command-line shell and scripting interface for Drupal. It has also switched all download links from the project's pages to HTTPS.

The core update status module still doesn't use secure transport, but this is being worked on and will be deployed in the next Drupal update, the security team said in a blog post.

For now, website administrators can use a supported version of Drush to deploy updates or can manually download the release archives from their corresponding project pages.

The failed update notification issue and the CSRF flaw have not been addressed yet, but the Drupal security team opened tracking tickets for them and asked developers to contribute patches.

A discovery by a well-known Google security researcher provides further proof how antivirus programs designed to shield computers from attacks can sometimes provide a doorway for hackers.

Tavis Ormandy, an information security engineer with Google, wrote he found bugs in Trend Micro's antivirus product that could allow remote code execution by any website and steal all of a users' passwords.

The security firm has confirmed it has released an automatic update that fixes the problems.

"As part of our standard vulnerability response process we worked with him to identify and address the vulnerability," wrote Christopher Budd, global threat communications manager at Trend Micro, in an email on Monday. "Customers are now getting protections through automatic updates."

Ormandy posted emails he exchanged with Trend officials, occasionally expressing his frustration that the company wasn't moving fast enough.

"So this means anyone on the internet can steal all of your passwords completely silently, as well as execute arbitrary code with zero user interaction," Ormandy wrote. "I really hope the gravity of this is clear to you, because I'm astonished about this."

Trend's antivirus product has a password manager, and users can elect to export their passwords to it. The password manager is written in JavaScript and opens up multiple HTTP remote procedure call ports to handle API requests, Ormandy wrote.

In 30 seconds, Ormandy wrote he found one that would accept remote code. He also found an API that allowed him to access passwords stored in the manager.

Overall, Ormandy wrote that he found over 70 APIs exposed to the Internet, not all of which he had investigated for security issues. He suggested Trend should hire an external consultancy to audit the code.

Antivirus applications run with high-level privileges on operating systems, which means that exploiting a vulnerability can give an attacker deep access to a computer.

Dozens of serious vulnerabilities have been found in the last seven months in antivirus products from vendors including Kaspersky Lab, ESET, Avast, AVG Technologies, Intel Security (formerly McAfee) and Malwarebytes.

One-time passcodes, a crucial defense for online banking applications, are being intercepted by a malware program for Android, according to new research from Symantec.

The malware, called Android.Bankosy, has been updated to intercept the codes, which are part of so-called two-factor authentication systems.

Many online banking applications require a login and password plus a time-sensitive code in order to gain access. The one-time passcode is sent over SMS but also can be delivered via an automated phone call.

Some banks have moved to call-based delivery of passcodes. In theory, that provides better security since SMS messages can be intercepted by some malware, wrote Dinesh Venkatesan of Symantec in a blog post on Tuesday.

But Bankosy has been updated to forward all calls to the attackers, Venkatesan wrote. In the Asia-Pacific region, many operators use a service code in the format *21*[destination number]# to forward calls, which Bankosy has implemented.

The malware also "has support for disabling and enabling silent mode in addition to locking the device so that the victim is not alerted during an incoming call," Venkatesan wrote.

The one-time passcode is used with the victim's login credentials, which the attackers have presumably already obtained.

Symantec detected Bankosy in July 2014. A technical writeup from that time shows the malware also prompted victims to enter their payment card information in a more bold attempt at fraud.