The next year will see the continued blurring of lines between the worlds of IT security and what we’ve come to think of as the ‘rest of our lives.’ But those who expect to see a large shift in malicious activity to the Internet of Things in 2014 will be disappointed. That, according to a report from the security firm Trend Micro, which argues that Internet of Things malware and attacks are still a ways off – as cyber criminals await a “killer app” that will boost adoption and provide a common platform to attack. The prediction is part of “Blurring Boundaries,” a 2014 outlook report from Trend that argues IoT threats are mostly future-tech. “While we certainly think that attacks on IoT devices and the underlying architecture will be a major area of attack in the future, that future will not be until 2015 and beyond” writes Robert McArdle, […]
published research
How Connected Consumer Devices Fail The Security Test
The Internet of Things leverages the same, basic infrastructure as the original Internet – making use of protocols like TCP/IP, HTTP, Telnet and FTP. But the devices look and act very differently from traditional PCs, desktops and servers. Many IoT devices run embedded operating systems or variants of the open source Linux OS. And many are low-power and many are single function: designed to simply listen and observe their environment, then report that data to a central (cloud based repository). But IoT devices are still susceptible to hacking and other malicious attacks, including brute force attacks to crack user names and passwords, injection attacks, man in the middle attacks and other types of spoofing. Despite almost 20 years experience dealing with such threats in the context of PCs and traditional enterprise networks, however, too many connected devices that are sold to consumers lack even basic protections against such threats. […]
Senator Asks Automakers About Cyber Security, Privacy Plans
Cyber attacks on so-called “connected vehicles” are still in the proof of concept stage. But those proofs of concept are close enough to the real thing to prompt an inquiry from U.S. Senator Ed Markey, who sent a letter to 20 major auto manufacturers asking for information about consumer privacy protections and safeguards against cyber attacks in their vehicles. Markey’s letter, dated December 2, cites recent reports of “commands…sent through a car’s computer system that could cause it to suddenly accelerate, turn or kill the breaks,” and references research conducted by Charlie Miller and Chris Valasek on Toyota Prius and Ford Escape. That research was presented in an August demonstration at the DEFCON hacking conference in Las Vegas. [For more on the security threats facing connected vehicles, check out this link.] “Today’s cars and light trucks contain more than 50 separate electronic control units (ECUs), connected through a controller area network […]
BitCoin’s Popularity Is Undermining Promises of Anonymity
The virtual currency Bitcoin has soared in value against the U.S. dollar in recent months, topping out a staggering $913 USD to 1 Bitcoin (or BTC) as of late Tuesday. The currency had many ups and downs since it was launched in January 2009. But its main attraction, all along, has been anonymity. Unlike any other online payment system, Bitcoin transactions – like cash transactions – cannot be traced back to specific individuals. Also like cash, they cannot be reversed. Both those factors give Bitcoin users the confidence that their online purchasing activity – whether computer hardware or contraband will remain private. But a group of researchers at two U.S. universities have released a paper that suggests reports of Bitcoin’s anonymity may (to paraphrase Twain) “be greatly exaggerated.” Specifically: the researchers found that, by culling a variety of open source data using public data from the Bitcoin Peer to Peer network and from […]
Hack Uses Phone’s Camera and Mic To Best Anti-Keylogger
Smart phones these days are bristling with sensors. Forget about the camera and microphone – there are accelerometers, Global Positioning System components, not to mention Bluetooth and NFC transmitters. All those remote sensors enable all kinds of cool features – from finding the nearest Starbucks to mobile payments. But they also pose a risk to the privacy of the phone’s owner – as malicious actors (and the occasional national government) look for ways to turn cameras and other sensors into powerful, cheap and convenient spying tools. Now researchers at The University of Cambridge have demonstrated one possible, new attack type: harnessing the built-in video camera and microphone on Android devices to spy on an owner’s movements and guess his or her password. The technique could be a way for cyber criminals to defeat anti-keylogging technology like secure “soft” keyboards used to enter banking PINs and other sensitive information. The work […]
