Mac hacked in 2 minutes


Recommended Posts

We a company called MSI in our hospital this week, doing security checks via DDOS attacks, etc on our network to see how secure we our, we run a strict MS network and so far they've managed to bring down 5 systems since Monday

Windows is scary.

If they didn't manage to bring down every system in the building, it wasn't a very good DDOS attack. I'll assume you actually meant they DDOS attacked your gateway(s), in which case you'll need to figure out what's wrong with your routers if a single machine went down.

If the "etc" includes internal security testing, and they managed to break into 5 windows systems, that's a failure by your IT department. As is evidenced by the fact that no one took home the 20,000 dollar prize on the first day, running a current and fully patched OS from Apple, MS or Ubuntu provides a very secure platform against network based attacks.

and your reply to the windows PC, is actually true, it was done in my Security Class before i graduated, just like i also used the MMC to remotely connect to a machine across the classroom and edited their registry(entrys in MMC go to registry) to lock their startmenu, edit permissions. and at a LAN party as a practical joke, inserted a couple porn vid's to a friends startup. if i have physical access to it but its locked, i can BART it, remove the PW, load the registry into BART Edit that, and do whatever else to the system

there is no Bull***, its fact as iv done it, my job requires me to break into a system @ customers request, or recover files/information if they can no longer access their computer

Not to be offensive, but you sound like you just discovered the ping of death download for win95. If hacking into a remote machine via a LAN was still possible without an admin password, we'd be reading about the guy that walked away with 20k, not 10 or 5.

Most of the posters here can break into a system and recover files given physical access, as usual there's of course free tools available for us all to download.

Vista Laptop was Won!: Congratulations to Shane Macaulay from Security Objectives - he has just won the Fujitsu U810 laptop running Vista Ultimate SP1 after it was installed with the latest version of Adobe Flash.

Ah, good ol' adobe flash, MS couldn't have asked for a better ad for silverlight.

'' So at the end of the last day of the contest, only the Sony VAIO laptop running Ubuntu was left standing. '' -- haha, OSX isnt that secure afterall, now is it? and its great sitting behind ubuntu right now, laughing at you dear Apple followers who are so arrogant and ''OSX is soo secure'' .

a healthy dose of reality never did anyone no harm

Here's a picture of Charlie (in the foreground) exploiting the MacBook Air from his own laptop, while Aaron from TippingPoint verifies the pwnage in real time.

charlie_miller.jpg

http://dvlabs.tippingpoint.com/blog/2008/0...er-with-picture

LOL he is using a macbook... now we know what hackers use and why osx has no viruses and windows so much hehe

/joke

Well that assumption isn?t correct,can you explain why OSX had a surge in vulnerabilities the last 2 years? (aprox)

Obviosuly the OS has evolved since,but evolved negatively or positively? i have no doubt that has evolved in a positive manner,however the switching to the x86 architecture,the introduction of new features not related to designers,and the increasing user base,this bring a whole new choices of configurations in every system.

This reason make me belive that OSX is entering a dangerous era,in few words OSX isnt a Multistellar OS,and this transision will cause a lot of damage,this menas that apple has no idea in wich terrain is entering,competing with an expierenced and dominant Windows,that has been testes and tested by hundreds of million people all over the world,with i may say infinite configurations,and this is the day that winows still has problems with drivers from many manufacturers.

Apple proposed this chanllenge

and Microsoft says ?bring it on?

Excellent argumen(Y)(Y)

id have to disagree and say Linux Zealots, lol, with Mac close behind, but Mac VS Windows, yea Mac

They are Zealots for a reaso;) ;)

Wrong. Currently they are a lot more secure because there just aren't nowhere near as much real security threats circulating for Mac. Infact the number of those is close to ZERO.

Have they ever spread very far or were able to do anything harmful?

So if Vista will reach the marketshare XP has (won't happe:woot:ot: ) it will be as unsecure as XP?

Your argument is flawed.

Seriously, if you want to really secure your system, this is how:

1) Turn it off

2) Remove the harddrive, RAM and processor

3) Put each component in an airtight and awesomely secure compartment

4) Put them in a Swiss Vault

5) Start praying so that no one carpet bombs that plac:laugh:gh:

there was more involved then going to a site

and your reply to the windows PC, is actually true, it was done in my Security Class before i graduated, just like i also used the MMC to remotely connect to a machine across the classroom and edited their registry(entrys in MMC go to registry) to lock their startmenu, edit permissions. and at a LAN party as a practical joke, inserted a couple porn vid's to a friends startup. if i have physical access to it but its locked, i can BART it, remove the PW, load the registry into BART Edit that, and do whatever else to the system

there is no Bull***, its fact as iv done it, my job requires me to break into a system @ customers request, or recover files/information if they can no longer access their computer

You're describing things that are documented as supported features / functionality on Microsoft.com, not hacks. If you're connecting via MMC / remote registry, you already have admin permissions on the box. Of course you can screw with it, you're an admin.

If you have physical access to the machine, you own it. You can install another OS and read any unencrypted data, mess with the OS, or even just install a new one. Any idiot script kiddie can do that. And not just to Windows, they can do it to Linux or Mac OS just as easily.

If you really want to talk smack, then do something interesting, like:

1) Compromise EFS encrypted data

2) Retrieve a user's password (not reset it). Of course, that's not really possible unless the user actually types it in for you

3) Compromise a domain-joined machine's network credentials

4) Compromise a BitLocker'd machine

Of course, what everyone is really worried about are things like remote code execution and elevation of privilege attacks. Somehow I'm not too worried about you or your security class finding any of those.

Right :rolleyes: and Vista and UAC is bulletproof too.

the issue with your comment, is that most people dont claim vista and UAC are bullletproof, yet a majority of mac users do make such claims about osx

not true.

and what system do you claim cannot be compromised with physical access??

clicked the damn wrong button.

as he said that is not a physical access hack. do you actually know what a physical access hack means?

Edited by whocares78
you missed where i said "connect to a machine across the classroom"

and all passwords can be bypassed, or gotten

noone missed the point, they just stated the obvious, i think you may have missed the point. across the classroom is on the same network and you still needed the admin password or an administrative account to use.. e.g. i am domain admin on my lan and as a result can do whatever i like to any machine on the network.

p.s. not all passwords can necesarily be bypassed or gotten.. you may have used an elevated privelegde expliot or somethign to get the admin password which is totally different from what you described, but anyway i think i wil pass on using your great expertise to test my security...

Wouldn't help. I know people that have Bachelors in Computer Science that can hardly even use a computer.

i know people with MCSE's that have no idea how to change an IP address, anyone that knows IT knows all certs mean is that you can read books :)

the issue with your comment, is that most people dont claim vista and UAC are bullletproof, yet a majority of mac users do make such claims about osx

"Majority of americans are stupid". - See what I did there?

Don't make assumptions based on vocal people on the net - they don't represent more than a fraction of any OS user base, maybe even less. Just because you read a few blogs or forums where people claim this or that doesn't suddenly make "majority" agree with them.

Edited by daPhoenix

Simple fact of the matter is, whatever OS your using, if you don't visit the website in the spam email, you don't get compromised. Perhaps more should be done by ISPs and free email hosts etc in terms of detecting and closing down the machines which spew the endless streams of spam emails rather than just focusing on operating system and browser a, b or c having flaws.

I think it's good to know that Microsoft's efforts towards security has paid off with a now secure OS. Obviously all users operating a computer of any OS still need to maintain it (i.e. download updates)

Im a Mac user and i hope that Apple are quick to patch this hole in safari, as long as the holes are not too stupid ive never had a problem with them being discovered as i know that something as complex as an OS is bound to have holes in it here and there, what really shows me strength is the speed in which these hole are fixed.

It's also good to see the Linux distribution with the most attention (ubuntu) come through with flying colors, as a large share of ubuntu users are switchers coming from another OS (such as windows and Mac OS X) it's good to know that while they are learning there way around the OS they are being protected.

(on a slightly different note i am still not convinced with Vista, i use a dual boot XP/Vista Ultimate x86 SP1 machine at work P4 3.4GHZ 2GB RAM SATA HDD's nVidia 7600GT. My machine has a couple of niggles with Vista, the hard disks are always thrashing away, there is not many docs on my computer as they reside on the server, after a week i would have thought it would have subsided after a couple of weeks. I also have a niggle where Vista will lose network connectivity, it shows as connected but it won't talk to the network, ive tried updated drivers. My XP OS is much faster without any of the above issues.

The reason why i mention this long winded side note is that Vista's excellent performance through the hacking contest gives me a lot of hope for the next release of Windows.)

No but vista is much more secure than OSX

statistical results prove it

shhhhhhhhh

I'd love to see your "statistical results".

Not said by the people who know,imagine all this vulnerabilities in Mac OSX with this tiny market share,then imagine if Mac OSX has 93% of market share (DANG!),now imagine that windows (Vista and XP) has lesser vulnerabilites with 750 million computers than OSX with 50 million pc at the most,and im being optimistic.

Can you see the breach?

Hope so,otherwise i'm so sorry :)

No one can see it unless you can tell us exactly how many vulnerablilities are in OS X and how many are in Windows.

on the MMC/Remote Registry NO Sh** when did i say i didnt have the PW, i wasnt an admin of that box though, slack*** part on the actual admin for having a week/widely known PW.

for your talk smack stuff

(1) Recovery ( not reset) of EFS passwords/hash's i personally dont use it as i dont need EFS recovery (found via link below) ( 2 for 1 special)

(2) see above, or This Thread i found this page trying to find the name of the program i actually use by the name of Petter N Hagen ( Linux based PW tool )

(3)as far as i know, the network credentials are authenticated against the server and not stored on the local machine, only the local PW is

(4)here is your bitlocker thing,, i knew about the Bitlocker/Filevault bypass, this is just a videoBitlocker Bypass Video

there is your requested info ( except 3 as i didnt really answer it )

You're describing things that are documented as supported features / functionality on Microsoft.com, not hacks. If you're connecting via MMC / remote registry, you already have admin permissions on the box. Of course you can screw with it, you're an admin.

If you have physical access to the machine, you own it. You can install another OS and read any unencrypted data, mess with the OS, or even just install a new one. Any idiot script kiddie can do that. And not just to Windows, they can do it to Linux or Mac OS just as easily.

If you really want to talk smack, then do something interesting, like:

1) Compromise EFS encrypted data

2) Retrieve a user's password (not reset it). Of course, that's not really possible unless the user actually types it in for you

3) Compromise a domain-joined machine's network credentials

4) Compromise a BitLocker'd machine

Of course, what everyone is really worried about are things like remote code execution and elevation of privilege attacks. Somehow I'm not too worried about you or your security class finding any of those.

FileVault Sucks

yet a majority of mac users do make such claims about osx

there are remote password retrieval tools, so yes they can, its just a matter of how long it will take a person to break it. so STFU and get off the bandwagon and go back to MickyD's your late for work

about my instructor/class he was CCNE as well MS, and it was not a hacking class moron

p.s. not all passwords can necesarily be bypassed or gotten.. you may have used an elevated privelegde expliot or somethign to get the admin password which is totally different from what you described, but anyway i think i wil pass on using your great expertise to test my security...
Edited by Hell-In-A-Handbasket

Ho boy...

on the MMC/Remote Registry NO Sh** when did i say i didnt have the PW, i wasnt an admin of that box though, slack*** part on the actual admin for having a week/widely known PW.

Guessing a weak password isn't really hacking of course.

(1) Recovery ( not reset) of EFS passwords/hash's i personally dont use it as i dont need EFS recovery (found via link below) ( 2 for 1 special)

Hopefully your instructor told you that uploading your sam to a questionable third party is about the worst thing you could do to a company.

(2) see above, or This Thread i found this page trying to find the name of the program i actually use by the name of Petter N Hagen ( Linux based PW tool )

These types of tools have been around more than 20 years now, it's nothing new to anybody.. We've all heard of or used L0pht, cain and able, pwreset.. the list goes on. None can help remotely crack a pc, they all need to get at the sam via an administrator password or boot disk. Not a remote hack.

(3)as far as i know, the network credentials are authenticated against the server and not stored on the local machine, only the local PW is

Research "cached credentials" Domain or AD or Active directory.

(4)here is your bitlocker thing,, i knew about the Bitlocker/Filevault bypass, this is just a videoBitlocker Bypass Video

We all knew about the new cold boot attack on encryption keys, now make it work... without downloading someone else's tool, otherwise you're the security equivalent of a script kiddie.

there are remote password retrieval tools, so yes they can, its just a matter of how long it will take a person to break it. so STFU and get off the bandwagon and go back to MickyD's your late for work.

Yup, there sure is... ALL require admin access to get the sam.

about my instructor/class he was CCNE as well MS, and it was not a hacking class moron

Hmmm, many of the posters (myself excluded) can be a source of incredible information, and many know far more about security than either myself, you or your instructor could hope to learn in a lifetime.

You'll gain no respect by calling knowledgeable people morons, you just make yourself look silly.

never said anywhere that i hacked anything, crack/hack are 2 different things

never said uploading sam anywhere, was talking about on the machine itself, or moving the sam to a different machine

i know those tools are old, never said they were new, and i don't remember saying anything about remotely attacking the sam ( if im wrong please quote that part )

im not a programmer, tried learning it but wasn't my thing, i don't do anything illegal, and everything is at request, and a script kiddie just uses the tools and doesnt know how it does it, that they just push a button and it does it, i actually know, so i doubt i qualify as a script kiddie, i don't do the bitlocker bypass and dont need to do it, it was listed because it was requested. and i didnt say any of those programs were for remote password retrieval, it wasn't asked for remote password retrieval, just for password retrieval, and i have said multiple times then i have access to the machine when asked to recover the password

found Cached AD/Domain, wasnt aware of the cache, and when required to change/get AD-Domain pass, we just changed it and had user change it to something else on next login, so thank you for pointing that out ( not said in anger ) as wasnt aware of it/forgot it if it was brought up in class as haven't messed with AD in over 3 years (Server 2003 was not even being deployed when i messed with AD, so it was all 2000 stuff)

about the gaining respect, i dont care, im not here in search of it, and in the thread i have given answers multiple times, so the person can alter what was asked, or totaly revoke the answer like it didnt exist because it wasnt good enough for them / didnt belive it. because they have it in their head that it doesnt exist, i know linux people that are the same way when their linux box crash's in front of their face, and they deny it crashed/locked, and when asked why it did it, they deny it doing it because " it cant", just like Windows/Mac users to the same extent.

this thread was made as nothing more then to flame mac like they were some sort of security wall of godness, thinking windows machines were somehow better because it wasnt attempted until after the Mac was won,, it was the Air,the flavor of the month, of course people are going to target that first, and of course the person that did the iPhone jailbreak could do it do fast, he probably used the same website. but somebody comes in to an anti-mac thread and not only Agreeing to the issues regarding Mac security and pointing out that its not only Mac but Windows,, people go apesh**. ok you win, Windows are impervious to all things, i dont know squat and my career in computers for 15 years is just a waste of my time i should go do trash collecting or something.

Peace Out

Ho boy...

Guessing a weak password isn't really hacking of course.

Hopefully your instructor told you that uploading your sam to a questionable third party is about the worst thing you could do to a company.

These types of tools have been around more than 20 years now, it's nothing new to anybody.. We've all heard of or used L0pht, cain and able, pwreset.. the list goes on. None can help remotely crack a pc, they all need to get at the sam via an administrator password or boot disk. Not a remote hack.

Research "cached credentials" Domain or AD or Active directory.

We all knew about the new cold boot attack on encryption keys, now make it work... without downloading someone else's tool, otherwise you're the security equivalent of a script kiddie.

Yup, there sure is... ALL require admin access to get the sam.

Hmmm, many of the posters (myself excluded) can be a source of incredible information, and many know far more about security than either myself, you or your instructor could hope to learn in a lifetime.

You'll gain no respect by calling knowledgeable people morons, you just make yourself look silly.

"Majority of americans are stupid". - See what I did there?

Don't make assumptions based on vocal people on the net - they don't represent more than a fraction of any OS user base, maybe even less. Just because you read a few blogs or forums where people claim this or that doesn't suddenly make "majority" agree with them.

i make assumptions on what i know and hear from working in IT and uninformed users telling me what they think and the most common thing i hear about macs is they are bulletproof my old boss used to even try to tell me macs were bulletproof of course he was a draftsman who just happened to know the most about computers quite a few years before i came along so got the job as it manager, and believe me i dont just go on what LTD says and i do realise not all mac users are stupid enough to make such claims. p.s. from expierience i have to also agree with you that a vast majority of americans are stupid although there are some inteligent ones over there, as with anything there are majoritys and minoritys

there are remote password retrieval tools, so yes they can, its just a matter of how long it will take a person to break it. so STFU and get off the bandwagon and go back to MickyD's your late for work

about my instructor/class he was CCNE as well MS, and it was not a hacking class moron

when it takes you more than a year to brute force a secure password then i aint worried and dont count that as cracking a password becasue i would have changed it by the time you can get it.. and there are also ways to avoid/ minimise the chance of someone even getting to your sams in the first place, but hey your security course should have covered that, hell pick up hacking for dummies and it will tell you (as well as all the stuff you have said in previous posts).

i am slightly worried your instructor of a security course (security/hacking/cracking its all basically the same thing really its all symantecs that i dont waste my time with that crap) had no security certifications e.g. Security+, CISSP, etc etc cisco and MS certs dont make you a security guru. and anyway i think i said earlier certs mean nothign when it comes to knowing what your talkign about and i have found the people that insist on getting more and more certs are the ones that have no clue. but thats just my opinion from my expierience dont take that as me bagging you in any way.

and honestly a job at maccyd's i am guessing that is mcdonalds, is honestly a tempting choice after 12 years working with computers, but i was leaning more towards a job as a lawnmower man, ahh not having to worry about servers going down and customers threatening to sue you cause your software doesnt work as they think it is supposed to.

when it takes you more than a year to brute force a secure password then i aint worried and dont count that as cracking a password becasue i would have changed it by the time you can get it.. and there are also ways to avoid/ minimise the chance of someone even getting to your sams in the first place, but hey your security course should have covered that, hell pick up hacking for dummies and it will tell you (as well as all the stuff you have said in previous posts).

how many people actually use a secure password, and by secure i mean the whole kitnkaboodle as far as caps/numbers/symbols/length. the strongest i have seen in use is on my laptop which is just numbers/letters, the rest ( including alot of my passwords because i have nothing that needs secured but all at least have multiple numbers and letters ) use their favorite baseball team, their dog, aka weak passwords, and im sure a secure one wont take a year with the speed of comps, yes they would have taken a year when 486 ruled the earth,but alot shorter on a 5 year old computer ( quickest i have done a PW retrieval is 2 days, but it was just numbers/letters with 1 cap )

i am slightly worried your instructor of a security course (security/hacking/cracking its all basically the same thing really its all symantecs that i dont waste my time with that crap) had no security certifications e.g. Security+, CISSP, etc etc cisco and MS certs dont make you a security guru. and anyway i think i said earlier certs mean nothign when it comes to knowing what your talkign about and i have found the people that insist on getting more and more certs are the ones that have no clue. but thats just my opinion from my expierience dont take that as me bagging you in any way.

he had a stack of certs and a degree, the Cisco/MS cert were an example as i feel the those garentee a well secured career, i seriously doubt an institution would not have somebody qualified to instruct, actually i think its will easily get the institutions accreditation pulled when reviewed and sued by the people attending.

i only have 1 other cert that i need to get ( its an OEM cert thats required by the OEM )

but i can understand where your coming from as far as getting more and more certs, imho a person without certs can know a ton more info than a person with certs, the only thing the certs do is give a piece of paper with a corporate/educational backing, when i was repairing Copiers with Pitney Bowes, i had to get Pitney Bowes Certified for the copiers i was working on, i have no idea why as i wouldn't be there if i didn't know how to fix it, but that piece of paper gave the customer ( who has no idea who i am ) reassurance that i could fix it, and im guessing the company a fallback as in " he's a certified copier technician ", but after 2 years i hated driving 100 miles to work, then an additional 50 to each office in a day( i covered multiple territories), although it was fun i hate long drives

and honestly a job at maccyd's i am guessing that is mcdonalds, is honestly a tempting choice after 12 years working with computers, but i was leaning more towards a job as a lawnmower man, ahh not having to worry about servers going down and customers threatening to sue you cause your software doesnt work as they think it is supposed to.

this is America, land of the lawyers, people have sued MickyD's cause they spilled coffee on themselves, lawn people can get sued because their grass wasn't cut right

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • In the way that you framed it incorrectly. You wrote: "The constant need to close all browser sessions and wait for a new version to install" There's no "constant need to close all browser sessions". That's factually incorrect. The browser downloads its updates in the background and installs them when you open it again. Silently. And there's no "wait for a new version to install", updates are small and take 2-3 extra seconds AT MOST, if any. If you have an SSD, there's zero extra time. Also, every mainstream browser operates this way. Firefox, the FOSS go-to browser, the default on almost every Linux distro, does exactly the same. Also, you don't need to constantly restart Edge for updates to install, you can completely ignore them and it doesn't even ask you to handle them, it's all silent and automatic. So I don't understand what else do you want.
    • DuRoBo Krono Review: Portable E-Ink reader with great ideas that need a bit of improvement by Taras Buria Phone-sized e-readers are gaining traction these days, with more people treating them as a getaway device to cure phone addiction (or at least they are trying to) or having a more pocket-friendly reader that is easier to carry and hold. The market now has plenty of such readers to choose from, and DuRoBo is the latest addition, a new player that offers a more interesting approach to the idea. The Krono is a $279 e-reader with an interesting twist, which tries to make the device more fun and ergonomic. Here is my review. Disclaimer: DuRoBo provided the review sample without any editorial input or pre-approval. The Krono comes in a phone-sized box with pink accents. Inside, you get the device itself, a short user manual, and a USB cable. The cable is a bit old-fashioned, Type-A to Type-C, which is a bit disappointing. Hot take: I would rather have no cable in the box rather than another Type-A cable that gets immediately thrown into my box full of similar cables I never use. The Krono also has no charger in the box, as it relies on accessories you already own, which is fine with me. Here are the specs: Dimensions 154 x 80 x 9.0 mm or 6.06" x 3.15" x 0.35" 173 g or 6.10 oz Materials Black or White plastic Display 6.13-inch E-Ink Carta 1200, 1,648 x 824 pixels, 300 ppi Touch-capacitive. Dual-tone frontlight. Processor 8-core Qualcomm Snapdragon 690 (QTI SM6350) 2 performance cores at 2.07 GHz 4 efficiency cores at 1.71 GHz Memory 6 GB Storage 128GB, non-expandable ~104GB available out-of-the-box Operating system Android 15 with a custom launcher Connectivity Wi-Fi and Bluetooth Battery 3,950 mAh battery Buttons and port USB Type-C port Power button, Volume button, Smart Dial Breathing Lights Audio Mono Speaker and Dual microphones In the box The Krono, a Type-A to Type-C cable, user manual Price $279 on Amazon First impressions Right off the bat, no, this is not a phone replacement. Do not approach this device thinking it can serve you as a dumb phone to cure your TikTok addiction. In addition to the fact that the Krono has no cellular connectivity, I strongly believe that no amount of extra devices can fix your phone addiction until you put some serious effort into it. The Krono is a phone-sized e-reader, a companion for your phone dedicated to reading without distractions. The DuRoBo Krono is made of plastic with a very fine texture. It is hardly premium, but I also cannot say it feels cheap. The device is also a bit thick, quite dense, and well-built without rattling or cracking. You get to choose between two colors: white and black. The front has quite thick bezels, which is hardly surprising for an e-ink device. These things use front light, with LEDs usually placed on the screen perimeter. While I do not mind thicker bezels, the notably larger chin cheapens the look a little. What I mind is a notable seam between the display and the main case, which, after just two days of use, collected plenty of dust and specks. The back of the Krono is what makes the device stand out. There is a cylinder (DuRoBo calls it the Axis) embedded in the back of the reader, housing three elements: a power button on the right edge, a Smart Dial on the left edge, and "Breathing Lights" on the back. An etched DuRoBo logo sits below the cylinder, and it is the only piece of branding you can find on the device. Overall, the design and materials are very unassuming, but the cylinder with additional control elements certainly elevates the look and makes it more interesting. Other physical elements include two microphones (one on the top edge and one on the bottom edge), a USB Type-C port, a volume rocker, and a single mono speaker. There is no fingerprint reader, so if you want to protect your device, a PIN is your only option. The official TPU case is not the most premium-looking Display The Krono has a 6.1-inch E-Ink Carta 1200 touchscreen display with a resolution of 1,648 x 824 pixels (300 ppi). The display is front-lit, and you can adjust the brightness and temperature from cool to warm. Unfortunately, the Krono lacks automatic brightness and temperature adjustments, and you cannot set a custom schedule for the frontlight. However, you can set it to always enable frontlight so that you can see what is happening on the screen when turning it on in a dark environment. On the bright side (get it?), the front light can get extremely dim so that the screen is barely readable in a pitch-dark room. The front light is also uniform across the screen, with no noticeable temperature gradients. I am very susceptible to uneven front light, and it is very easy for me to notice it, but the Krono is doing a very good job in this area. I also like that the edge shadow is not very prominent and barely visible in the black variant. E-Ink Carta 1200 is not the newest generation (there are Carta 1250 and 1300), but it is still a good display. It supports three modes: Clarity, Speed, and Quality. In Clarity mode, text is very sharp and easy to read, but you trade that for more ghosting, a slower refresh rate, and more artifacts when the display changes images. Speed mode, as the name suggests, boosts refresh rate and reduces ghosting, but fine print and text become more jagged. Finally, Quality mode is only available in Android apps. It has the lowest refresh rate, but in return, you get much better visuals, improved gradients, and more. Like brightness and temperature, you can toggle modes from the control center. It is available when swiping from the top-right corner of the screen (the top-left is for notifications). I also like that the Krono can work as a desk clock when not in use. It has a bunch of screensavers, including horizontal clocks with time, date, and current battery level. The screen refreshes once per minute, and battery drain is extremely low (not even 1% in 24 hours). It is a great use of the technology, and another thing I wish more e-ink devices featured. Smart Dial The Smart Dial is Krono's main party trick. It sits on the left side of the device and serves multiple purposes. You can twist or press it to perform various actions, depending on the current use case scenario. When reading books, twisting the dial flips through pages, and pressing it refreshes the screen. On the home screen, the dial adjusts the brightness, and holding the dial pressed launches voice note recording. Finally, a quick double press launches the DuRoBo AI chatbot. While the dial scroll is not notched, it is very smooth and has haptic feedback that confirms your actions, which feels very nice. As a long-term Apple Watch user, I love the idea behind the dial. It feels very natural and oddly satisfying to use, especially with that subtle haptic feedback. I never liked flipping pages with touch input, and I strongly believe each e-reader should come with some sort of physical controls for turning pages. The Krono has both volume buttons (which also work as page turners) and the dial, so you are free to use whichever you prefer. With that said, the dial is not perfect. For one, it sticks out of the case way too far for my liking, raising concerns about durability and longevity when carrying the Krono around in a pocket (it is a pocket-sized device after all). Also, it has too much wobble, which cheapens the experience and makes it feel a bit flimsy and unsecured. While there are two plastic guards on the Krono's case, they are way too small for any kind of protection. I also think DuRoBo should let users customize dial actions (the only available customization is scroll direction), particularly for long and double presses. Not everyone needs voice notes, and DuRoBo AI does not work without an active internet connection, leaving the long press essentially useless when offline. I do not mind these features, and I genuinely think they are useful, but I would rather have the ability to toggle between screen modes, turn the frontlight on/off, or launch my favorite app. I also agree with people on Reddit asking developers to let users adjust the dial sensitivity. I hope this is something DuRoBo can implement with a software update to make the experience more personalized (it is a Smart Dial, after all) and incentivize users to fiddle with the Dial more often. The Dial is a fantastic idea, so please, guys, improve it a little. As for ergonomics, they are mostly fine, but the dial's position may feel a little awkward and way too high. When I use a phone or a phone-sized gadget, I tend to rest one of its corners on my palm for a more secure grip. With the Krono, such a grip is impossible because you cannot reach the dial even with big hands. You have to lower the reader a bit and hold it like a bottle without any extra support for the bottom edge. Such a grip is not necessarily uncomfortable (the Krono is also light enough for it), but it requires a bit of muscle retraining. Sometimes, I do not bother with the dial and hold the Krono like my phone, flipping through pages with volume buttons, as they are perfectly positioned for my right-hand thumb. Interestingly, when testing the Krono, I would often find myself thinking that a roller embedded in the long plastic cylinder on the back of the device would have been a much more comfortable solution. There is a free idea for you, guys. Software The Krono runs Android 15 with a very minimal launcher on top. The home screen presents you with a list of apps, a scrollable list of widgets, and your user profile. Widgets can display time, calendar, or recent books for quick access. You can also add or remove apps from the home screen to keep the most useful stuff around without tapping "Apps." I like this minimalistic approach; it looks clean, easy to understand, and light. I understand that some may find the list of all apps way too clean, but fortunately, DuRoBo lets you switch to traditional icons. The reader also has a bunch of preinstalled apps: Read: The default app for reading. Browser: A Chromium-based browser. Files: A simple file manager. Music: A simple music player. Spark: A voice recorder with transcription support and AI summarization DuRoBo AI: A built-in AI chatbot. Transfer: An app for file transfer over Wi-Fi. If that is not enough, there is the Google Play Store, where you can download all the extra apps you need, alternative readers, podcast apps, chatbots, and more. DuRoBo is not trying to give you an all-in-one device. The standard software experience is quite minimal, which makes it easy to approach and learn. The standard reader supports EPUB, EPUB3, AZW3, MOBI, PDF, TXT, DOC, and DOCX, which is more than enough to let you read most books without third-party software. As for customizing the reading experience, you can select one of five built-in fonts, adjust size and thickness, adjust margins and spacing (only three variants for each), change text alignment and direction, toggle the reading status bar, and switch to dark mode. There is also text-to-speech, which utilizes Android's default TTS tech. While I like the simplistic approach, I cannot help but feel DuRoBo could have made the built-in reader a bit more customizable. However, I am not going to bog down on this, as you can always install any other reader you prefer using the Play Store or by sideloading an APK. Getting books to the Krono is very simple. Given that the device is an Android smartphone without cellular connectivity, you can transfer files via a USB Type-C cable, download them using the built-in browser, share them over Bluetooth, or use cloud storage. My favorite was the built-in Transfer app. It is simple, reliable, and very well-designed. I was surprised by how well-designed the web portal is. It is fast, pretty, and properly categorized. Well done! Once you have your books loaded, you can highlight or underline text, add annotations, bookmark pages, check the table of contents, and ask AI about the selected text. Unfortunately, the Krono has no built-in vocabulary, but again, that is something a third-party reader could fix. Overall, the built-in reader is light and snappy, with just the minimum amount of features for a regular user to enjoy reading books. The Krono has no built-in reading tracking, so stat nerds will have to look for third-party reading apps. However, you can set a daily reading goal, and the reader will notify you when you reach it (for example, one hour). You can also set a reminder to read at a certain time, and when the time comes, the Krono will light up its back LEDs and unlock itself to nudge you. Other than that, the rear LEDs do nothing, not even showing charging progress, which is an unfortunate misopportunity if you ask me. Quirks aside, Krono's Android runs quite snappily and bug-free. Early reviews of the Krono criticized its Android 13-based software quite a lot, but now, the reader runs Android 15, and its software has fixed plenty of initial complaints. I never experienced any issues with built-in apps. AI attempts The DuRoBo Krono comes with a built-in AI chatbot. There is no information on what model powers this thing, but the system says it was "trained by Google." You can launch the bot from the app list or by double-pressing the dial. It works just like any other chatbot, and you can ask it anything by typing or using voice input. The AI saves your chats, and you can rename, export, or delete them. DuRoBo AI requires an active internet connection, and it does not work offline. Its reach and capabilities are also limited. You can only chat in the app and use it in the reader app as a makeshift vocabulary. However, the implementation is kinda awkward. You can only send a selected portion of text to AI without giving it any requests or instructions. I highlighted the word "dumb," and it apologized to me for not being useful. You also cannot ask follow-up questions or send the generated response to a separate chat. The chatbot is also slow, even with fast Wi-Fi, making the overall experience quite frustrating, which makes me again wish for the ability to remap the double press to something else. Spark, the standard voice recording app, also uses AI for note summarization and transcribing. Neither feature works offline, unfortunately. Spark records notes up to 30 minutes using Krono's dual microphones, and you can rename or export notes. Transcription quality is decent, and the speed is alright, but you can find much better solutions in the Google Play Store. What I like about Spark is that transcribed notes are not locked, and you can always type more to elaborate on your ideas, which is handy. Overall, I like that the Krono is not shoving AI down my throat, but to be honest, there is really not that much to shove. AI features here feel raw and need improvements to be more useful. Battery Life Like most E-Ink readers, the Krono has fantastic battery life. Even with a clock as a screensaver, its standby power consumption is incredibly low. And when in use, you can get weeks of reading on a single charge. Without the front light, my unit never sipped more than one or two percent of battery during a one-hour reading session. It was nice to see plenty of battery-related settings. You can limit charging at 80% to protect battery health long-term, check the number of charging cycles, manufacturing/first-time use date, battery health, and the maximum capacity. Additionally, the Krono lets you select what hardware remains enabled when sleeping. This lets you keep Wi-Fi and Bluetooth on (say, if you want to receive notifications, for some reason) and keep audio playing when locked. Turning these features off effectively eliminates any standby battery drain. I left my Krono sitting for 24 hours with a clock screensaver on, and it did not drop a single percent. The pretty big 3,950 mAh battery justifies the device's thickness and ensures you do not have to charge it for long periods. Speaking of charging, it is capped at only 10W, which is a bit disappointing, as getting such a big battery to 100% takes a notably long time in the era of super-fast charging smartphones. DuRoBo Moodi The Moodi is a standalone, optional accessory for your Krono. It is a wireless remote with two customizable buttons that you can use to flip pages, control media, or scroll webpages. The accessory connects via Bluetooth. Despite having a built-in rechargeable battery, it is extremely light. While the Moodi's shape and form factor is not what I would call particularly ergonomic, it is not uncomfortable to hold and use. The Moodi comes with six removable magnetic buttons with various smiley faces. Buttons sit securely, and they have nice-feeling, albeit a little loud, clicks. It is a cute touch that adds a little more fun and character to the device. There is also an accented power button and a single status LED. The latter displays charging status and connection mode. The Moodi supports three modes: Reading: Buttons work as volume buttons, allowing you to flip pages in the built-in reader or other apps that support page turning with volume buttons. Media: Buttons work as skip forward/backward, which is useful when listening to audiobooks, podcasts, or music. Scroll: The third mode lets you scroll pages in the web browser or any other application The Krono properly detects the Moodi and presents you with an on-screen guide when you connect it for the first time (it also displays the battery level). However, you can only change modes by holding both buttons for a few seconds. It is also worth noting that the Moodi works with other devices. I connected it to my iPhone and it let me adjust volume or control media playback. Sadly, the scroll did not work, so you cannot use it to waste time scrolling TikToks. Overall, the Moodi is a cute little accessory, which I can recommend for those who read a lot. It is very useful for remote page flipping when you do not want to burden your hands by holding the Krono all the time. I only wish DuRoBo included a lanyard for the built-in loop. As for the battery life, after using the Moodi for a few days, I only managed to drop several percent of its 90 mAh battery. Despite the small size, it is rated for weeks of use, which is pretty impressive. At $35.99, I cannot say the Moodi is a must-have accessory, but I see the appeal. I prefer using the Krono with its Smart Dial, as I rarely read for more than 40-60 minutes in one sitting. However, if you have a stand and like reading for long periods, the Moodi is the right thing to have. It is a bit more expensive than regular page flippers on Amazon, but it is on par with similar products from Kobo or BOOX. Plus, it has a little more fun to it with removable buttons and better integration into the Krono. Conclusion At the end of the day, DuRoBo Krono is a nice pocket-sized e-reader. Its software focuses on the main things without trying to be everything at once. The smart dial idea is unique and great, and I wish more manufacturers had something similar in their devices. The display is also good, with an even frontlight and "always-on" support. I did not notice any deal-breaking issues with the Krono. However, you can feel that the idea needs some improvements, such as a slightly stiffer dial in a more ergonomic location, perhaps a little more premium materials, and better software customization. I hope the company won't give up on the idea and improve the dial and ergonomics in the second generation. Buy DuRoBo Krono Black - $279.99 on Amazon Buy DuRoBo Krono White - $279.99 on Amazon Buy DuRoBo Moodi - $35.99 on Amazon As an Amazon Associate, we earn from qualifying purchases.
    • In what way is any of what I said incorrect? To install an update you need to close all browser instances, upping it from once a month to once a fortnight is an inconvenience for users. Particularly when updates don't offer functionality that users want (notably copilot). Security updates should come as they are needed, not on a release schedule
    • Dopamine 3.0.6 by Razvan Serea Dopamine is an awesome free audio player which tries to make organizing and listening to music as simple and pretty as possible. Dopamine has been designed for Windows 7, Windows 8.x and Windows 10 and plays mp3, ogg vorbis, flac, wma and m4a/aac music formats quite well. The best part? It's created by long-time Neowin member, Raphaël Godart. If you’re looking for a music player to handle a large music collection, you should definitely give Dopamine a try. Dopamine 3.0.6 changelog: Fixed Manually edited album covers are overwritten on the next collection refresh Fixed AppImage package not working on modern GNU/Linux distributions Deleting song from playlist sometimes fails Playback controls only work when clicking on upper half of the buttons It's unclear that files must be tagged with an external ReplayGain scanner (for example rsgain) before normalization can take effect. Change to Artist or Album tags is not reflected in the song list view nor in the Now Playing information ReplayGain issues Smart playlist filters ignore text containing accents or other special characters Some MP3 files trigger an "MPEG header not found" error due to a too-narrow initial MPEG header scan range Changed Updated the Vietnamese translation Download: Dopamine 3.0.6 | 122.0 MB (Open Source) Links: Home Page | Forum Discussion | Screenshot | Other OSes Get alerted to all of our Software updates on Twitter at @NeowinSoftware
  • Recent Achievements

    • One Month Later
      AndreaB earned a badge
      One Month Later
    • One Month Later
      agatameier earned a badge
      One Month Later
    • Week One Done
      agatameier earned a badge
      Week One Done
    • Week One Done
      ssd21345 earned a badge
      Week One Done
    • Contributor
      MarkHughes4096 went up a rank
      Contributor
  • Popular Contributors

    1. 1
      +primortal
      516
    2. 2
      +Edouard
      193
    3. 3
      PsYcHoKiLLa
      147
    4. 4
      ATLien_0
      96
    5. 5
      Steven P.
      76
  • Tell a friend

    Love Neowin? Tell a friend!