security | Paul Wallbank - Communications Professional

Google’s Android problems point the way for the Internet of Things

How Google handle ongoing Android security issues will be a pointer for protecting the Internet of Things

As regular security problems are being exposed in the Android operating system, Google and Samsung have announced regular updates to their devices and software.

For long timers in the IT industry this is a return to the Microsoft days of Patch Tuesdays, the monthly bundle of updates for Windows and Office the company used to issue on the first Tuesday of each month.

While Android has nothing the like the problems Microsoft did in the early 2000s with the explosion of malware that crippled millions of users, the risks to the Google system are real with some predicting a security armageddon.

For users, there’s a serious question in the problems facing Android system in that unlike the Windows systems the rollout of updates is controlled by the telcos or handset vendors rather than the software developers.

As a consequence many older devices simply aren’t being updated leaving millions of smartphone users exposed to malware and having no way of fixing known security problems.

The problems facing Android are common across the entire Internet of Things, how Google respond the current smartphone security problems is going to be a pointer for the rest of the IoT sector.

The need for an IoT manifesto

As the internet of things rolls out, more care in the design of products and services will be needed

Last May at the ThingsCon conference in Berlin a group of European designers came together to form the IoT Manifesto.

Now vendors have the ability to put a chip into almost anything companies and designers are tempted to add connectivity simply for the sake of doing so.

In many cases this is opens up a range of security risks ranging from the screaming baby monitor to the hackable jeep.

Coupled with the security risks of your intimate devices being hacked there’s the related privacy risks as millions of devices collect data ranging from how hard you press your car’s brake pedal through to last time you burned your breakfast toast.

In an era where governments and businesses are seeking to amass even more information about us, there are genuine concerns about what that data is going to be used for and why it is being collected in the first place.

The IoT manifesto looks to manage these problems facing the sector through ten guiding design principles;

Don’t believe the hype around the IoT
Only design useful things
Deliver benefits to all stakeholders
Keep everything secure
Promote a culture of privacy
Gather only a minimal amount of data
Be transparent about who that data will be shared with
Give users control over their data
Design durable products
Use the IoT and its design to help people

All of the principles are laudable and it’s not hard to think that meeting the guidelines would make devices and services that aren’t just useful and safe but also simpler, cheaper and more effective.

There’s many ethical, business and safety issues facing the Internet of Things as connected devices rollout across almost every industry. The IoT Manifesto may well be a good framework in which to design them and the cloud services they’ll depend upon.

Security, smartcars and Microsoft Windows – ABC Nightlife July 2015

Security problems with smartcars and dating sites along with asking if a new version of Microsoft Windows matters any more

Security problems with smartcars and dating sites along with asking if a new version of Microsoft Windows matters any more are the topics for July’s Nightlife tech spot.

Paul Wallbank regularly joins Tony Delroy on ABC Nightlife on to discuss how technology affects your business and life.

If you missed this month’s show, you can listen to the program through the ABC website.

July’s Nightlife

A decade ago people lined up all night for a new version of the Windows operating system. Next week Microsoft will be launching Windows 10 to an indifferent market place, does what was once the world’s biggest software company matter anymore in a world of smartphones, connected cars and cloud computing?

Some of the questions we’ll be answering include.

So what are Microsoft announcing next week?
What happened to Windows 9?
Does Windows really matter any more?
The internet has changed things but not always for the better. What about connected cars being hacked?
Is this a bigger problem than just connected cars when we’re seeing things like kettles being wired up to the internet?
Of course it’s not just cars suffering problems on the Internet, adult dating site Ashley Madison has had potentially 37 million customers’ details leaked online.
Could this happen to any business? How do we protect ourselves?

Listeners’ questions

A few of the questions from listeners couldn’t be answered on air.

Running Flash of iPhones and iPads: Steve Jobs’ hatred of Adobe Flash was legendary and as consequence iOS devices like the iPhone and iPad don’t come with the ability to run the software. That’s a problem for those who need Flash for some packages.

The Puffin web browser gives iPad and iPhone users the ability to use Flash on their devices and is available from the iTunes store.

Securing Android: While smartphones are less prone to viruses and malware than personal computers, they still are at risk. For Android users there is no shortage of choice for security packages, some of which include;

Android power hogs: A downside with smartphone apps is they can drain battery life. One excellent feature on Android phones is the ability to easily check what’s using your juice.

Open device settings
Scroll to “about phone”
Click on “battery use”

Join us

Tune in on your local ABC radio station from 10pm Australian Eastern Summer time or listen online at www.abc.net.au/nightlife.

We’d love to hear your views so join the conversation with your on-air questions, ideas or comments; phone in on 1300 800 222 within Australia or +61 2 8333 1000 from outside Australia.

You can SMS Nightlife’s talkback on 19922702, or through twitter to@paulwallbank using the #abcnightlife hashtag or visit the Nightlife Facebook page.

A series of weak links

Security continues to be a challenge for Internet of Things vendors

One of the ongoing discussions in the world of the Internet of Things are the security weaknesses in many devices that leave networks vulnerable to rogue devices or malicious hackers.

A good example of this is Craig Hockenberry’s post on his Furbo.org site on how bugs in Apple’s Bonjour software messes with networks.

While Apple won’t say what causes this issue – an ominous point in itself – Hockenberry surmises it’s due to older software in some devices that no longer have updates available, which is another problem facing the IoT.

On top of Hockenberry’s story, a piece in Threat Post reports the Open Smart Grid Protocol has serious security issues.

The writers of the package that’s installed on more than four million smart meters and similar devices worldwide decided to write their own encryption algorithm that has proved easy to break.

So the smart home which might feature both a slew of Apple devices and one of these exposed smart meters has a range of security holes that the occupier has no idea about. This hardly breeds confidence.

As the Internet of Things is rolled out, security is going to have to be at the front of developers’ and vendors’ minds. The stakes are too high for shoddy and ill thought out compromises or for vendors like Apple who rate secrecy over their customers’ security.

Hacking medical devices

Security researchers show how easy it is to hack a medical robot

Security experts have hacked a teleoperated surgical robot Security experts hack medical robot.

In a recently published paper, a group of academics showed how they had been able to change the instruction sequences, override commands or even take full control of the Raven II medical robot.

That such a lack of security isn’t in the least bit surprising is a sad commentary on the world of connected devices and the Internet of Things.

At the root of this problem is the software running this equipment has security added, at best, as an afterthought given the designers work from the assumption operators are in the room with the equipment,

If we’re going to connect these devices to the public internet then security has to be built into them from the beginning.

Whether we’re discussing remote medical equipment, driverless cars or the smart home, hardening and securing IoT devices is going to be of today’s industrial challenges.

Microsoft’s server clock counts down

Microsoft’s ending of support for Windows Server 2003 marks the end of the box software era.

One of the challenges facing Microsoft are the millions of users quite happily using the company’s older products.

While Windows XP is by far the biggest problem – only last year the number of systems running the fourteen year old operating system still outnumbered those running the latest version – Microsoft faces similar issues with its server 2003.

This week Microsoft warned support for Windows Server 2003 has entered its last one hundred days and urged customers to look at shifting onto new systems.

Interestingly most of the case studies they cite involve customers moving from on premise servers onto cloud services.

While that’s very good advice as most customers, particularly small businesses, don’t have the capabilities it shows how the industry has shifted in the last twelve years.

For most of those companies a decade ago cloud service, or Software as a Service (SaaS) as it was known then, weren’t available for most business functions. Today they are the norm and usually the best option for smaller operations.

That shift to the cloud has meant an entire industry now faces extinction as the army of suburban IT service companies that once maintained those servers are now largely redundant.

As the clock ticks down on Windows 2003 server so too does it for all the businesses that once depended upon the PC industry.

How the Internet of Things could overtake the law

The internet of things is going to present challenges for governments and regulators.

Last March the Australian internet industry celebrated twenty years of commercial operations with the Rewind/Fast Forward conference that looked at the evolution of the online economy down under and its future.

Naturally the Internet of Things was an important part of the discussion looking at the internet’s future and one of the panels examined the effects of the IoT on industry and society.

During the session chairman of the Communications Alliance industry association, John Stanton, raised an important point about how the IoT creates problems for existing laws and the regulators as a wave of connected devices are released onto the market place.

The risks are varied, and Stanton’s list isn’t exhaustive with a few other aspects such as liability not explored while some of the issues he raises are a problem for other internet based services like cloud computing and social media.

Roaming rules

Having fought many regulatory battles over roaming charges and access between networks, it’s not surprising Stanton and the Communications Alliance would raise this as an issue.

Dealing with roaming devices will probably be a big challenge for mobile Machine to Machine (M2M) technologies, particularly in the logistics, airline and travel industries. We can expect some bitter billing battles between clients and their providers before regulators start to step in.

Number schemes

Again this is more an issue for mobile M2M consumers. Currently every SIM card has its own phone number once the service is activated. It may be that regulators have to revise their numbering schemes or allow providers to use alternative addressing methods to contact devices.

Data sovereignty

Where data lives is going to continue to be a vexed issue for cloud computing consumers, particularly given the varied laws between nations.

Short of an international treaty, it’s difficult to see how this problem is going to be resolved beyond companies learning to manage the risks.

Identity management

Data integrity is essential for the IoT and accurately determining the identity of individuals and devices is going to be a challenge for those designing systems.

Over time we can expect to see some elegant and clever solutions to identity management in the IoT however masquerading as a legitimate device will always be a way malicious actors will try to hack systems.

Privacy

For domestic users, the privacy of what remains in data stores is going to be a major concern as domestic devices and wearables gather greater amounts of personal information. We can expect laws to be tightened on the duties and obligations of those collecting the data.

Access Security

Who can do what with a networked device is another problem, should a malicious player or a defective component get onto the system, the damage they can do needs to be minimised. What constitutes unlawful access to a computer network and the penalties needs to be carefully thought out.

Spectrum allocation and cost

Governments around the world have been reaping the rewards of selling licenses to network operators. As the need for reliable but low data usage IoT networks grows, the economics of many of the existing licenses changes which could present challenges for both the operators and governments.

Access to low cost and low data access networks

Following on from the economics of M2M networks, the question of mandating slicing of scarce spectrum for IoT applications or reserving some frequencies becomes a question. How such licenses are granted will cause much friction and many headaches between regulators and operators.

Commercial value of information

How much data is worth will always be a problem in an economy where information is power and money. This though may turn out to be more subtle as information is only valuable in the eyes of the beholder.

Where information becomes particularly valuable is in financial markets and highly competitive sectors so we can see the IoT becoming part of insider trading and unfair competition actions. These will, by definition, be complex.

Like any new set of technologies the internet of things raises a whole new range of legal issues as society adapts to new ways of doing business and communicating. What we’re going to see is a period of experimentation with laws as we try to figure out how the IoT fits into society.

The high cost of distrust

A lack of trust in data is going to cost the world’s economy over a trillion dollars forecast a Cisco panel

A lack of trust in technology’s security could be costing the global economy over a trillion dollars a panel at the Australian Cisco Live in Melbourne heard yesterday.

The panel “how do we create trust?” featured some of Cisco’s executives including John Stewart, the company’s Security and Trust lead, along with Mike Burgess, Telstra’s Chief Information Security Officer and Gary Blair, the CEO of the Australian Cyber Security Research Institute.

Blair sees trust in technology being split into two aspects; “do I as an individual trust an organisation to keep my data secure; safe from harm, safe from breaches and so forth?” He asks, “the second is will they be transparent in using my data and will I have control of my data.”

In turn Stewart sees security as being a big data problem rather than rules, patches and security software; “data driven security is the way forward.” He states, “we are constantly studying data to find out what our current risk profile is, what situations are we facing and what hacks we are facing.”

This was the thrust of last year’s Splunk conference where the CISO of NASDAQ, Mark Graff, described how data analytics were now the front line of information security as threats are so diverse and systems so complex that it’s necessary to watch for abnormal activity rather than try to build fortresses.

The stakes are high for both individual businesses and the economy as technology is now embedded in almost every activity.

“If you suddenly lack confidence in going to online sites, what would happen?” Asks Stewart. “You start using the phone, you go into the bank branch to check your account.”

“We have to get many of these things correct, because going backwards takes us to a place where we don’t know how to get back to.”

Gary Blair described how the Boston Consulting Group forecast digital economy would be worth between 1.5 and 2.5 trillion dollars across the G20 economies by 2016.

“The difference between the two numbers was trust. That’s how large a problem is in economic terms.”

As we move into the internet of things, that trust is going to extend to the integrity of the sensors telling us the state of our crops, transport and energy systems.

The stakes are only going to get higher and the issues more complex which in turn is going to demand well designed robust systems to retain the trust of businesses and users.

Rampaging Ransomware

How long until we see ransomware infecting smart devices asks a Romanian security researcher?

A few years ago Ransomware was a joke, malware would install a screen that would demand a ransom be paid to ‘unlock’ the computer. It was easy to get around and almost trivial to remove.

Then came Cryptolocker, a nasty piece of malware that would gleefully encrypt a victim’s hard drives, rendering them inaccessible unless a sizeable ransom was paid.

Ransomware suddenly became serious.

Cryptolocker eventually was unpicked with a cracking tool released and the ring’s alleged founder, Evgeniy Bogachev, now on the run from US authorities with a three million dollar reward for his arrest.

A better class of ransomware

Now the gangs running the ransomware scams are even more sophisticated and well resourced with Andrei Taflan of Romanian security company BitDefender describing how Bitcoin values are often tracking ransomware activity.

“When we see Bitcoin values surging we watch for increased ransomware activity. Someone is buying Bitcoins to unlock their data,” Taflan told me last week in an underground bar appropriately called The Rabbit Hole.

Taflan’s colleague Bogdan Botezatu describes how the ransomware problem is getting worse, not better, with Cryptowall patching the weaknesses that led to Bogachev’s downfall.

One of the fascinating aspects of Cryptowall is that it’s polymorpic – it changes shape to elude traditional signature based anti-virus programs. The malware also creates unique Bitcoin wallets to make tracking transaction harder.

Paying the ransom

Many businesses being infected by Cryptowall and having data locked away by an industrial grade encryption program makes it a no brainer to pay the demands. It’s a profitable business.

Faced this rather impressive piece of work, Botezatu raises a chilling prospect about ransomware in the Internet of Things; how long, he asks, will it take ransomware to target more sensitive devices we use, including cars and medical implants?

Botezatu’s concern illustrate why security with the Internet of Things is absolutely essential if industry and the public are to have any confidence in connected devices.

Locking down the firmware of the internet of things

As the smart devices become common in our homes, cars and workplaces suppliers will have to do more to secure their software.

There’s a fundamental problem with smart devices warns Kim Zetter and Andy Greenberg in Wired magazine.

In Why Firmware Is So Vulnerable to Hacking, and What Can Be Done About It, Zetter and Green look at the problem with the embedded software that is shipped with every computerised device from Personal Computers to smart sensors.

The problem with firmware is that it’s difficult to check it’s not been changed, awkward to upgrade and complex to find, the Wired piece mentions how even the batteries in Apple laptops have vulnerable software embedded into their chips.

As the smart devices become common in our homes, cars and workplaces suppliers will have to do more to secure their software.

Technology’s crisis of trust

Last night for the monthly ABC Nightlife tech spot we looked at Samsung’s spying TVs and some of the other aspects of security with connected devices.

During the listeners’ calls it became very clear many are worried and scared by technology’s rapid progress. This is a challenge for the leaders of both the tech industry and governments.

Trust in the tech industry isn’t being helped by the revelation Lenovo computers have been loaded with Adware that, among other things, interferes with secure website connections.

Lenovo’s actions raise a serious concern for business as many of those home units may have been connected to office networks under corporate Bring Your Own Device policies and the spoofing of security certificates could cause no end of problems and risks for IT managers.

Another concern Lenovo’s actions raise is about the Internet of Things; if various devices on a network are messing with data integrity, confidence in the information being generated is eroded.

For the tech industry, it’s essential to regain the community’s trust. Equally however it’s essential for business and political leaders to have an honest conversation with voters and workers on how the structure of the workforce is changing.

Your TV is watching you. ABC Nightlife February 2015

For the February 2015 Nightlife we look at spying TVs, the internet of rubbish bins and robot hotels

Paul Wallbank joins Tony Delroy on ABC Nightlife nationally from 10pm Australian Eastern time on Thursday, February 19 to discuss how technology affects your business and life.

If you missed the show, the program is available for download from the ABC site.

For the February 2015 program Tony and Paul look at robot driven hotels, the internet of rubbish bins and how your TV could be listening to you.

Last year a lawyer read the terms and conditions of his new Samsung TV and discovered that the company recommended people don’t discuss sensitive information around it. This has lead to widespread, and justified, concerns that all our smart devices – not just TVs but smartphones and connected homes – could be listening to us. What happens to this data and can we trust the people collecting it?

The internet of rubbish bins

It’s not only your TV or smartphone that could be watching you, in Western Australia Broome Shire Council is looking at tracking rubbish bins to make sure only council issued ones are emptied.

Shire of Broome waste coordinator Jeremy Hall told WA Today the council’s garbage truck drivers had noticed more bins than usual were getting emptied and a system needed to be put in place to identify “legitimate” bins.

While Australian councils are struggling with rubbish bins a hotel in Japan is looking to replace its staff with robots and room keys with face recognition software. The Hen-na Hotel is due to open later this year in Nagasaki Prefecture, the Japan Times reports.

Join us

Tune in on your local ABC radio station from 10pm Australian Eastern Summer time or listen online at www.abc.net.au/nightlife.

We’d love to hear your views so join the conversation with your on-air questions, ideas or comments; phone in on 1300 800 222 within Australia or +61 2 8333 1000 from outside Australia.

You can SMS Nightlife’s talkback on 19922702, or through twitter to @paulwallbank using the #abcnightlife hashtag or visit the Nightlife Facebook page.