Tag: communications

FBI tried and failed to unlock 7,000 encrypted devices

In an 11-month period, the FBI failed to gain access to around 7, 000 encrypted mobile devices, BBC News reports , which is about half of those targeted by the agency according to FBI Director Christopher Wray. In a speech given at the Association of Chiefs of Police conference yesterday, he said that device encryption was “a huge, huge problem, ” for the agency. The FBI publicly went after Apple following the 2015 San Bernardino terror attack as it sought access to the shooter’s locked iPhone 5c — a request that Apple staunchly refused . It eventually got around the issue by paying an undisclosed vendor reportedly $900, 000 for software that gave the agency access to the phone. While that incident garnered a lot of attention, it certainly wasn’t the first time the FBI made it clear that encrypted smartphones were a headache for the agency. In 2014, then Director James Comey said that secure communications could lead to “a very dark place” and called on Congress to change the Communications Assistance for Law Enforcement Act accordingly. Further, while the FBI presented the San Bernardino attacker’s phone as a special case of national security, the Wall Street Journal reported that the Department of Justice was pursuing nine similar requests around the same time. Wray said at the conference, “I get it, there’s a balance that needs to be struck between encryption and the importance of giving us the tools we need to keep the public safe.” But as cybersecurity expert Alan Woodward told BBC News , encryption is here to stay. “Encryption that frustrates forensic investigations will be a fact of life from now on for law enforcement agencies, ” he said. “Even if the equipment manufacturers didn’t build in such encryption it would be possible to obtain software that encrypted data in the same way.” Source: BBC News

View the original here:
FBI tried and failed to unlock 7,000 encrypted devices

“NSFW” doesn’t begin to describe Bluetooth security in sex toys

Enlarge (credit: Michael Ochs Archives/Getty Images) Technologies such as Bluetooth Low Energy (BLE) have allowed an increasing number of devices to be controlled by mobile devices. But as Ars has reported in the past, BLE devices also can be a privacy and security risk. And as Alex Lomas of Pentest Partners  found recently, some of these vulnerable devices are of a very personal nature. Lomas discovered that he could relatively easily search for and hijack BLE-enabled sex toys—a pursuit he named “screwdriving” (after the Wi-Fi network finding practice of “wardriving”). Lomas performed a security analysis on a number of BLE-enabled sex toys, including the Lovesense Hush—a BLE-connected butt plug designed to allow control by the owner’s smartphone or remotely from a partner’s phone via the device’s mobile application. Using a Bluetooth “dongle” and antenna, Lomas was able to intercept and capture the BLE transmissions between the devices and their associated applications. As it turns out, reverse-engineering the control messages between apps and a number of devices was not terribly difficult—the communications between the apps and the toys were not encrypted and could easily be recorded with a packet capture tool. They could also be replayed by an attacker, since the devices accepted pairing requests without a PIN code—allowing anyone to take over control of them. Read 2 remaining paragraphs | Comments

More:
“NSFW” doesn’t begin to describe Bluetooth security in sex toys

Replacement screens can be used to hijack your phone

A new study has shown that one of the most common fixes to a stock smartphone ailment can be used to steal your data, and compromise your device. In the newly published paper, researchers from Israel’s Ben-Gurion University of the Negev reveal how a replacement screen can easily be altered to override your mobile. By embedding a malicious integrated chip within a third-party touchscreen, the research team were able to manipulate the communications system on a Huawei Nexus 6P and LG G Pad 7.0. This essentially allowed them to record keyboard inputs, snap pictures of the user and forward them via email, install apps, and direct the user to phishing websites. A second class of attack also saw them exploit vulnerabilities in the handset’s operating system kernel. Scariest of all, the researchers claim these hazardous screens can be made to look identical to the real thing — meaning even handset technicians may not be able to distinguish the difference. Furthermore, the entire process is file-less, allowing it to go undetected by anti-virus software. This type of low-cost attack is known as the “chip-in-the-middle” scenario. To carry out their malicious tasks, the researchers used an Arduino platform running on an ATmega328 micro-controller module. They also used an STM32L432 micro-controller, adding that most other micro-controllers could also do the job. They then used a hot air blower to separate the touchscreen controller from the main assembly boards, in order to access its copper pads. Next, they soldered a copper wire to attach their chips to the device. Although this set-up looks far from inconspicuous, the team claims a little more effort could easily hide the altered part within a reassembled device. It’s not just Android phones that are at risk either. The paper also indicates that iPhones could fall prey to the same types of attacks. Source: Yossi Oren

See the article here:
Replacement screens can be used to hijack your phone

US military will finally start encrypting soldiers’ emails

You’d think the military’s email service mail.mil would be more secure than Gmail and other free alternatives, but that’s apparently not the case. A Motherboard investigation in 2015 revealed that while it does have systems in place to protect classified messages, it doesn’t even use STARTTLS — a 15-year-old encryption technology that prevents emails from being intercepted in transit. That exposes unclassified emails to surveillance and leaves them vulnerable as they make their way to recipients. Now, after getting a lot of flak over the lack of security, Pentagon says it will finally start encrypting soldiers’ emails… but not until July 2018. See, Gizmodo discovered that the military’s email service doesn’t use STARTTLS, because it would prevent the Defense Information Systems Agency (DISA) from screening each message for malware, phishing attempts and exploits. A letter from DISA, which oversees the military’s emails, says its detection methods developed using national level intelligence “would be rendered ineffective if STARTTLS were enabled.” To be able to implement the technology and make it a default feature, it would have to migrate to a “new email gateway infrastructure, ” and migration won’t be done until July next year. DISA has revealed its plans to migrate the military’s email service in a letter addressed to Senator Ron Wyden, who questioned the agency for not using a “basic, widely used, easily enabled cybersecurity technology.” Wyden said in a statement that the move is definitely a step in the right direction, but he’s also pretty unhappy that it’ll take DISA a year to migrate. “Protecting the communications of American servicemen and women should be a priority, ” he said, “so I hope the agency accelerates its timeline.” Source: Gizmodo , Motherboard

Continued here:
US military will finally start encrypting soldiers’ emails

France gives you legal permission to avoid work email

New Year’s Day 2017 isn’t just a chance to reflect on the past and plan for the future… in France, it’s a new lease on life for many workers. As of January 1st, the country has enacted a law that requires companies with over 50 employees to negotiate times when staff have the right to ignore email and other communications. If there’s a deal, your employer can’t punish you for refusing to look at your messages beyond set hours. Does your manager need a spreadsheet update while you’re eating dinner? Too bad. And if there’s no deal, the company still has to explicitly outline expectations (and your rights) when you’re off the clock. The deal isn’t completely revolutionary when numerous companies have binding deals that prevent them from messaging workers who’ve finished for the day. And there’s a possibility that at least some companies will squirm out of this legal obligation by refusing to compromise on expectations and settling for the charter. Technology firms in particular have worried that this might hurt their productivity (the internet runs 24/7, after all), especially for employees that want to put in extra time. Still, it’s an important step in an era when many companies use smartphones to extract more hours from the rank and file. French companies will be more likely to respect your work/life balance — even if they don’t mark certain hours as off-limits, they can’t make unexpected requests that force you to drop everything. It could also reduce the pressure to prove your corporate loyalty by working whenever you’re asked. Source: Guardian

Taken from:
France gives you legal permission to avoid work email

Microsoft plans 7,800 layoffs, $7.8 billion Nokia write-down

After cutting its workforce by around 18, 000 over the past year, Microsoft is readying another round of heavy layoffs. The company will cut 7, 800 jobs over “the next several months.” Many of the dismissals will come from Microsoft’s phone business, which joined the company’s newly formed “Windows and Devices Group” in June. As part of the merger announcement, Microsoft also revealed it would say goodbye to the last two major Nokia executives still at the company, Stephen Elop and Jo Harlow , in the near future. It’s clear that CEO Satya Nadella wants Microsoft to be more focused than it has been in recent years. Nadella inherited a company in transition; its nascent Surface business had only just begun to find its feet, and the Nokia deal (arranged by the previous leadership team) had yet to complete. About that acquisition: Microsoft is writing-down a large portion of its value in the coming months — $7.8 billion — which is essentially a tacit admission that paying so much money for the flailing company was not the most financially sound decision. At the end of March, Microsoft had 118, 584 employees (down from 127, 000 in July 2014). Losing another 7, 800 represents yet another dramatic change within the company. In the past month, Microsoft has sold some of its Bing maps tech (and employees) to Uber, and also struck a partnership with (Engadget’s parent company) AOL to essentially hand off its display ad business . In an email to Microsoft employees , Nadella says the company remains “committed to our first-party devices including phones, ” but wants to “focus our phone efforts in the near term while driving innovation.” What does that mean? Apparently, it means running “a more effective phone portfolio, ” with a narrowed focus of “three customer segments.” It says business customers will get “the best management, security and productivity experiences, ” value phone buyers “the communications services they want, and Windows fans “the flagship devices they’ll love.” That suggests we’ll see more low-end Lumias, business-focused services and high-end Surface Pro-style devices in the future. [Image Credit: Stephen Brashear / Getty Images] Filed under: Microsoft , Nokia Comments Source: Microsoft

See the original post:
Microsoft plans 7,800 layoffs, $7.8 billion Nokia write-down

Nationwide Snooping System Launched In India

knwny writes “The Times of India reports that ‘India has launched a wide-ranging surveillance program that will give its security agencies and even income tax officials the ability to tap directly into e-mails and phone calls without oversight by courts or parliament, several sources said.'” Adds an anonymous reader: “What’s chilling is the comments from senior officials indicating that parts of the program are already live, without absolutely any discussion in public about it.” Read more of this story at Slashdot.

Continued here:
Nationwide Snooping System Launched In India

IRS Can Read Your Email Without Warrant

kodiaktau writes “The ACLU has issued a FOIA request to determine whether the IRS gets warrants before reading taxpayers’ email. The request is based on the antiquated Electronic Communication Protection Act — federal agencies can and do request and read email that is over 180 days old. The IRS response can be found at the ACLU’s website. The IRS asserts that it can and will continue to make warrantless requests to ISPs to track down tax evasion. Quoting: ‘The documents the ACLU obtained make clear that, before Warshak, it was the policy of the IRS to read people’s email without getting a warrant. Not only that, but the IRS believed that the Fourth Amendment did not apply to email at all. A 2009 “Search Warrant Handbook” from the IRS Criminal Tax Division’s Office of Chief Counsel baldly asserts that “the Fourth Amendment does not protect communications held in electronic storage, such as email messages stored on a server, because internet users do not have a reasonable expectation of privacy in such communications.” Again in 2010, a presentation by the IRS Office of Chief Counsel asserts that the “4th Amendment Does Not Protect Emails Stored on Server” and there is “No Privacy Expectation” in those emails.'” Read more of this story at Slashdot.

See more here:
IRS Can Read Your Email Without Warrant

Widespread Compromise Of Yahoo-Backed Email In New Zealand

First time accepted submitter Bitsy Boffin writes “Xtra, the largest ISP in New Zealand, which outsources email provision to Yahoo, has in the last two days been subject to a widespread email compromise, causing potentially thousands of accounts to send spam messages to every address in their webmail address books. Discussion at Geekzone centers around this potentially being a continuation of the Yahoo XSS exploit. While Telecom NZ, the owners of Xtra internet service provider indicate that the problem was “resolved”, reports of spam from its members continue unabated. Telecom NZ are advising those affected to change their passwords.” Read more of this story at Slashdot.

Continue Reading:
Widespread Compromise Of Yahoo-Backed Email In New Zealand

Open-Hardware Licensed Handheld Software-Defined Radio In the Works

An anonymous reader writes “Chris Testa recently presented at TAPR Digital Communications Conference and annouced his development work on a hand-held software defined radio. Running uClinux on an ARM Corex-M3 coupled to a Flash-based FPGA, it will be capable of receiving and transmitting from 100MHz to 1GHz. Designed to be low power, Chris has designed the radio primarily with the Amateur 2m and 70cm bands in mind. Currently in early prototyping stage, Chris intends to release the design under the TAPR Open Hardware License.” Read more of this story at Slashdot.

More:
Open-Hardware Licensed Handheld Software-Defined Radio In the Works