Category: security

Hacking the power grid through air conditioners

Air conditioners are the latest internet connected devices to raise security concerns

Another example of the unintended consequences of poor security in the Internet of Things is Wired’s story about the possibility of hacking the power grid by accessing smart air conditioners.

In the US, electricity companies offer deals where consumers get reduced bills in return for the utility being able to throttle the usage of air conditioners during peak power periods.

Those devices turn out not to be well secured which opens the possibility of malicious actors causing brownouts or service interruptions in a targeted areas.

Sadly this story isn’t isolated, too many connected devices have poor security that opens up the a range of risks to homeowners, businesses and the community at large.

 

Similar posts:

  • No Related Posts

BlackBerry’s last smartphone

The BlackBerry Priv is probably the company’s last smartphone as it pivots to being a security provider

Having written about BlackBerry’s ambitions in the marketplace for The Australian last week, it wasn’t surprising to be invited to the company’s Down Under launch of their Priv handset earlier today.

The event illustrated some brutal realities about mobile phone market and BlackBerry’s efforts to build on its strengths in the enterprise security space.

With 2.7 billion dollars of cash reserves, the company has seven years of breathing space at its current loss rates although it’s notable the stock market values the company at $3.5bn, implying investors value the business’ operations at a measly $800 million.

Given the collapse in BlackBerry’s handset business from twenty percent of the market at the beginning of the decade to an asterix today, that pessimism from investors isn’t surprising and underscores why the company is recasting itself as an enterprise security provider.

Five major acquisitions in the last 18 months have demonstrated how BlackBerry is attempting to recast its business; security services like Good Technology and Secusmart through to warning software like At Hoc have seen the company bolster its range of offerings.

Blackberry-software-chart

Coupled with the recent acquisitions are its own longstanding messaging and secure communications services combined with the QNX software arm that promises a far more reliable Internet of Things than many of the current operating systems being embedded into smart devices.

The Android smartphone system itself is bedevilled with dangerous apps running on outdated software and where BlackBerry hopes their PRIV handset can attract enterprise users conscious of the need to secure their employees’ devices.

For BlackBerry though, the PRIV being shipped with the Android operating system is a capitulation to the smartphone market’s stark reality where there is only demand for two products and outside players like BlackBerry or Windows are destined to wither away.

While the PRIV is a nice, albeit expensive, phone and the slide out physical keyboard is nice to use, the device seems to be a desperate attempt by the company to stay in the smartphone market.

As an outside observer it’s hard to see the justification for BlackBerry continuing as a phone manufacturer, there may be some intellectual property value from the development of the devices – although it should be noted the company only valued its IP assets at $906 million in November 2015.

While the PRIV is a perfectly good Android phone it will probably be the last smartphone BlackBerry makes, the challenge for the company’s management now is to tie together the software assets it has into a compelling suite of products for the enterprise sector.

In an age where devices of all types are going to be connected, the market for ensuring their security should be huge. Catering to that market should be BlackBerry’s greatest hope of survival.

Similar posts:

  • No Related Posts

Securing the drones

British and American spies were able to hack into Israeli and Syrian military drones. What hope is there for ordinary computer users?

While we assume military equipment has far higher levels of IT security, it isn’t always the case reports Ars Technica.

Allegedly the US National Security Agency and Britain’s GCHQ were able to intercept the video feeds of Israeli and Syrian drone aircraft using off the shelf software. While it appears security has become more sophisticated on this equipment, it is a concern that data feeds can be monitored from military equipment.

This is even more concerning given the reliance of software and telemetry systems in modern weapons. The troubled F-35 project shows just how complex computer code has now become in military equipment and it is safe to say some of those bugs will create weaknesses in the systems.

For those of us with more modest security needs, all is not lost though as Rob Joyce, the NSA’s hacker-in-chief, has given some useful tips on how to protect your systems. These are worth following although Joyce is quite clear that you’ll have to work hard to stay ahead of a sophisticated and persistent cyber-enemy.

Similar posts:

  • No Related Posts

Knowing what we don’t know

Cisco’s 2016 security report show businesses are more uncertain than ever about their network defenses. This is a good thing.

The 2016 Cisco Security report is in many ways an encouraging document, while it describes a litany of threats facing the modern business the fact managers are less confident about their defenses is a good thing.

Of the 2432 security executives surveyed 59% claimed their security infrastructure was up to date against 64 percent said the same. Acknowledging this is motivating them to improve their defenses.

For industry, the real concern is the small business sector where there’s a clear decline in the use of IT security tools. As the Target breach showed, trusted contractors and suppliers provide a weakness in an organisation’s systems that malicious actors are keen to exploit.

In Cisco’s analysis, the main reasons for SMBs lack of concern is their belief they are too small to be valuable to hackers and most of their IT management is outsourced.

A shift to the cloud shouldn’t be understated, particularly given many SMBs are shifting their IT functions onto cloud services. While this doesn’t fully protect businesses, the cloud providers certainly offer a far higher level of protection that the local plumbing contractor relying on a mom and pop computer support service.

The bad guys however are responding to that shift with Cisco reporting increased browser based and DNS attacks, both of these are useful in compromising cloud computing services which means both service providers and end users have to be vigilant about security.

At all levels of business though the lack of confidence in security has major ramifications as the Internet of Things is rolled out and common devices start being connected to fragile and often compromised networks.

The good news for vendors like Cisco is this lack of confidence could spur a new wave of business investment as companies improve their network security.

Another important aspect of CIOs and business owners not being confident about their network security is they are far less likely to assume their systems are safe or to passively accept vendor assurances about their safety.

For all of us a customers and users of these technologies, a greater focus on security by the organisations we deal with should be welcomed as well.

Similar posts:

  • No Related Posts

Anatomy of an internet exploit

The Angler exploit tells us much about the challenges of internet security

As one does on a weekend, I’m working my way through the 2016 Cisco Security Report.

There are plenty of insights on online security trends which I’ll cover in tomorrow’s blog post but one aspect that sticks out in the report is the case study on the Angler Exploit which takes advantage of hacked domain registrar accounts to create new domain names to serve phishing pages, ransomware sites and malicious advertisements.

Dealing with these sites is a major problem for network administrators and Cisco claims many of the domains registered haven’t yet been used by online criminals.

The Angler exploit shows just how complex internet security has become. The issue of trust is a complex thing and certainly no-one can trust every domain we see. That there are thousands of ‘disposable’ domains available to scammers only makes things more difficult for the average user.

Similar posts:

  • No Related Posts

The insecure internet of children’s toys

Security weaknesses in the Hello Barbie show safety is an afterthought rather than a fundamental part of designing tech products.

What could go wrong with an internet connected doll with artificial intelligence that can respond to children’s conversations?

A lot as it turns out.

The Washington Post reports the Hello Barbie has a range of vulnerabilities that could be used to eavesdrop on conversations and potentially carry out even more malicious acts.

Once again we see marketers and salespeople being ahead of the IT and security experts with the security of an Internet of Things device being seen as a bolt of afterthought rather than a basic design consideration.

Similar posts:

  • No Related Posts

Designing a secure IoT ecosystem

Ensuring the next generation of IoT devices is secure will be one of the challenges facing the next generations of designers.

Ensuring the next generation of IoT devices is secure and a good citizen of the wider ecosystem will be one of the challenges facing the next generations of designers.

Diego Tamburini, Manufacturing Industry Strategist of design software company Autodesk, spoke to Decoding The New Economy about how the IoT will change the design industry. “We’ve been designing equipment to connect to the internet for a generation,” he said. “What’s changing is that now the addition of software, electronics, networking and communication is breeding into objects that were purely mechanical.”

Melding the physical and software worlds doesn’t come without risks however, something that worries Internet pioneer Vint Cerf who foresees headlines like ‘100,000 fridges hack the Bank of America’ in an interview with Matthew Braga of Motherboard Canada.

Apart from the fact it could be a hundred million, Cerf has good reason to be worried. Most consumer IoT devices are hopelessly insecure and the recent stories of hacked cars only emphasises the weaknesses with connected household items.

Cerf and Braga make the point the ‘I Love You’ worm of the year 2000 became a crisis because the world had reached the point where personal computers were ubiquitous. A similar piece of malware in a world where everything from kettles to wristwatches are vulnerable would be exponentially worse.

These risks put a great onus on product designers, even more so given much of the functionality is based upon those devices communicating with others across the internet and cloud services, something that Tamburini emphasised.

“One important thing that is happening with thing being connected is we are not just designing things that function in a vacuum, we’re increasingly designing members of a larger ecosystem.” Tamburini states, “now we have to think of how the product will have to connect to other products and how they will collectively perform a function.”

Part of that risk is that should those devices malfunction, either deliberately as part of a botnet or malware attack, or accidentally as we saw with the connected home being disabled due to a defective smart lightbulb flooding the network with error messages, then the wider community may be affected in ways we may not expect.

Cerf believes it’s going to take a big, catastrophic hack on a grand, connected scale before a shift in security begins to happen, and before people begin to even consider that such a vulnerabilities even exist.

If that’s the case, it will be that society has ignored the clear warning signs we’ve seen from events like the Jeep hack and the Stuxnet worm, not to mention the massive privacy breaches at Target and Sony. For designers of these systems hardening them is going to be an essential part of making them fit for today and the future.

Similar posts:

  • No Related Posts