application security Archives

application security

Senator Asks Automakers About Cyber Security, Privacy Plans

December 4, 2013 Paul Roberts

Cyber attacks on so-called “connected vehicles” are still in the proof of concept stage. But those proofs of concept are close enough to the real thing to prompt an inquiry from U.S. Senator Ed Markey, who sent a letter to 20 major auto manufacturers asking for information about consumer privacy protections and safeguards against cyber attacks in their vehicles. Markey’s letter, dated December 2, cites recent reports of “commands…sent through a car’s computer system that could cause it to suddenly accelerate, turn or kill the breaks,” and references research conducted by Charlie Miller and Chris Valasek on Toyota Prius and Ford Escape. That research was presented in an August demonstration at the DEFCON hacking conference in Las Vegas. [For more on the security threats facing connected vehicles, check out this link.] “Today’s cars and light trucks contain more than 50 separate electronic control units (ECUs), connected through a controller area network […]

The French Disconnection: Radio Gun Stops Smart Cars In Their Tracks

December 3, 2013 Paul Roberts

You could call it “The Death of the Car Chase.” According to the BBC, a UK company, E2V is demonstrating the RF Safe-Stop, a 350 KG (770 lb) device that can shoot RF (radio frequency) pulses at moving vehicles, “confusing” the vehicle’s electronic systems and causing its engine to shut off, stranding both vehicle and driver. E2V’s Safe-Stop product is intended for use as a non-lethal weapon for the military and law enforcement and is marketed as a tool for “checkpoint enhancement,” “convoy protection” and “vehicle immobilisation” (sp). According to this BBC report, the device acts like a small radar transmitter, directing a beam of radio pulses (identified elsewhere as L and S-Band RF pulses) that saturate the wiring that connects the vehicles on board systems. Those pulses confuse the engine control unit and cause it to reset, stopping the vehicle. Safe-Stop sends a continuous stream of pulses to keep the ECU confused […]

Fix From LG Ends Involuntary SmartTV Snooping, But Privacy Questions Remain

November 25, 2013 Paul Roberts

The electronics firm LG issued a software update for some “Smart TV” models that were discovered spying on owners, but the company still faces scrutiny over its privacy policy. The company issued a firmware update for its LG 42LN575V model television sets, which were the subject of scrutiny last week after a UK-based technology consultant using the handle “DoctorBeet” discovered that his LG television was transmitting information about his viewing habits to company servers without his consent. The blogger, “DoctorBeet” (aka Jason Huntley, of Yorkshire, England) first wrote about his discovery on November 18, setting off a small firestorm of controversy. An analysis by Huntley uncovered a number of sketchy or outright illegal data harvesting behaviors. Among them: His LG television sent information on which channels he viewed to an LG-owned web domain. (The domain in question was not in service at the time.) The LG television relayed information on […]

At FTC Forum, Experts Wonder: Is Privacy Passé?

November 20, 2013 Paul Roberts

The U.S. Federal Trade Commission (FTC) used a one-day workshop to highlight security and privacy issues prompted by so-called “Internet of Things.” But attendees at the event may have walked away with a more ambiguous message, as prominent technologists and industry representatives questioned whether conventional notions of privacy had much relevance in a world populated by billions of Internet-connected devices. “I don’t feel like privacy is dead,” keynote speaker Vint Cerf, a Vice President and Chief Internet Evangelist at Google, told an audience at the FTC workshop. “I do feel like privacy will be increasingly difficult for us to achieve,” Cerf warned. And Cerf wasn’t alone in wondering whether that might not be such a bad thing – or even that unusual. “Is privacy an anomaly?” Cerf wondered aloud, recalling his experience living in a small, German town where the “postmaster knew what everyone was doing.” Our modern concept of being ‘alone […]

APT or fANTasy: The Strange Story of BadBIOS

November 15, 2013 Paul Roberts

Yesterday over on Veracode’s blog I wrote about the ongoing saga of “BadBIOS” – a piece of malicious software that might be the most sophisticated virus ever written, or a figment of the imagination of Dragos Ruiu, the esteemed security researcher who says he discovered it on systems he owned. The story of BadBIOS reads like something out of science fiction. Ruiu has described it in interviews and blog posts as BIOS-based malware that can back door systems running a variety of operating systems – OS X, Windows and even OpenBSD. But it’s also described as an ephemeral kind of ‘we-don’t-know-what,’ that can’t be isolated or analyzed. One Twitter follower of Ruiu’s suggested designating it a “heisenbug” which he defined as “a software bug that seems to disappear or alter its behavior when one attempts to study it.” That would be funny if this weren’t deadly serious. For, really, one […]