In-brief: Infoworld’s Roger Grimes makes the case that Google’s recent Rowhammer exploit may be a sign of things to come as attackers look for common platforms to attack the Internet of Things.
Tag: research
Wearable Cameras Birth A New Biometric
Wearable technology is a burgeoning category, and products like Google Glass and smart watches are just the beginning. As with mobile phones, on-board cameras are sure to be de rigueur. But, as this article over at The Verge notes, those cameras will present new challenges (for privacy) and new opportunities (for security). Specifically: cameras coupled with your body seem to create new kinds of opportunities to uniquely identify you. One example: gait biometrics. The Verge notes recent research published by Professor Shmuel Peleg and Yedid Hoshen of the Hebrew University of Jerusalem. Those researchers created a way to identify first-person filmmakers based on the signature wobble of their cameras. The identity of the user can be determined “quite reliably from a few seconds of video,” the researchers write in their paper. [Interested in biometrics and wearables? Check out our article “Are Wearables the Future of Authentication?“] “The idea of distinguishing one person from […]
BitDefender Finds Phone to Smart Watch Communications easy to Snoop
Researchers from the security firm BitDefender have found that it is possible to snoop on wireless communications sent between smart watches and Android devices to which they are paired. The researchers, led by Liviu Arsene, captured and analyzed raw traffic between the Nexus 4 Android device running Android L Developer Preview and the Samsung Gear Live smart watch. The traffic was captured on the Android device before it was transmitted to the associated smart watch using a baseband co-processor that it standard on most Android devices. According to BitDefender, the wireless traffic is secured using a six digit PIN code. That leaves the device vulnerable to computer-enabled “brute force” attacks that can try the million possible six digit codes in short order. BitDefender noted that the problem exposed wasn’t limited to smart watches. Using baseband co-processors on Android devices to handle encryption is “not a fool-proof security mechanism,” Arsene wrote. Attackers might also be […]
MITRE Gets $29m For First Cybersecurity Center of Excellence
MITRE Corporation has been awarded $29 million from the U.S. Commerce Department for the nation’s first federally funded National Cybersecurity Center of Excellence (NCCoE), according to a statement by the Commerce Department’s National Institute of Standards and Technology (or NIST). The contract charges MITRE with the job of operating the federally funded research and development center (FFRDC) in the areas of research, development, engineering and technical support; operations management; and facilities management. This is the first FFRDC dedicated to enhancing the security of the nation’s information systems, NIST said. The NCCoE was established in 2012 in partnership with NIST, the state of Maryland and Montgomery County, Md. It brings together experts from industry, government and academia to develop integrated cyber security solutions using existing, commercially available technology. “As the principal champion of the digital economy in the federal government, the Commerce Department is committed to defending our nation’s digital infrastructure from cyberattacks and helping American companies strengthen […]
Researchers Warn Of Flaws In Popular Password Managers
Researchers from the University of California, Berkeley have published a paper describing security holes in five, web-based password managers including LastPass, My1login and Roboform. According to the paper (PDF), four out of the five password managers inadvertently leaked a user’s credentials for stored web sites due to all-too-common web based security flaws like Cross Site Request Forgery (CSRF) and Cross Site Scripting (XSS). The researchers, Zhiwei Li, Warren He, Devdatta Akwawe and Dawn Song, all of the University of California Berkeley, said that they disclosed the holes in August of last year and that all of the affected firms and that all but one – NeedMyPassword – have since patched the vulnerabilities. All the password managers tested were found to contain one of a short list of security problems. Either they were vulnerable to classic web-based holes (like XSS), or they were found to be susceptible to user interface-focused attacks, like […]
