Application & Cyber Security Blog

The Blessing and Curse of Apple Security

A lot has been written about whether Apple should comply with the recently publicized FBI demands surrounding the San Bernardino attack last year. However, I’m going to avoid the political side of the debate and focus on the technology instead.  One could argue Apple has fallen victim to the old adage of  “be careful what you are good at.”  I discussed this topic with several peers at Security Innovation (thank you all, btw!) We seem to collectively agree the security that Apple has built into the iPhone over the last few years has been impressive and likely got them into this situation in the first place. If they weren’t so good at security, the FBI could retrieve this data on their own using their own security experts and technology.

The Apple device in question is a 5c. It’s likely that it is using iOS 8 or higher in which case most files are encrypted. The data on the device is stored in encrypted form with password-based encryption, by means of a user PIN. There is no easy way of gaining access to this data without cracking the PIN. This version’s auto lock feature enforces an auto-erase function that kicks in after 10 failed PIN attempts with an increased delay after every attempt to thwart a brute force attempt. All of the password guess attempts are tracked by the OS (not in hardware – more on this later). This is brilliant security design for its intended use, which is to prevent a lost or stolen from having all its confidential data extracted by a malicious user. However, for the FBI this means they would only have a certain number of attempts at getting the password correct before data is erased permanently, which is a very difficult task.

What the FBI asked for in their initial request is essentially for Apple to make a version of iOS that bypasses or disables the auto-erase function and doesn't purposefully delay the passcode attempts. FBI also requested for the iOS version to allow the PIN guesses to be sent over USB (rather than having to be entered by hand on the screen). This request would help the FBI make unlimited PIN requests using their laptops at the max speed of one passcode every 80ms rather than having to type the passwords repeatedly using the small iPhone screen. This would require Apple to patch the OS, sign it with their firmware signing key, side load it on the phone after putting it in DFU mode, and then give it to the FBI. Device Firmware Update mode is an iPhone mode that allows the user to change and choose the firmware the user wants to install on the device - without having the iTunes to automatically load the latest version of iOS on to the iPhone. The FBI would then attempt to brute force the PIN and unlock the phone. From a technology perspective, this is simple for Apple to do.

This situation might have gotten even stickier had the gunman used a newer iPhone version. The iPhone devices 5S and later are designed in a way that Apple probably couldn’t even help them even if they were willing. In these newer versions, the device encryption keys are stored inside what is called as a Secure Enclave. This is basically a separate component outside your iOS that just shares the same hardware space with the iPhone. When the user enters a passcode, it is combined with the key stored inside the Secure Enclave to unlock the device. The Enclave has its own counter and delays the passcode attempts by up to an hour when 9 or more attempts are made. The iOS secure Guide (page 11) provides a detailed view of how the Secure Enclave works. Though the Secure Enclave would make things difficult for the FBI, Apple could still be able to circumvent their own security process and make things easier if needed. This would be accomplished with an additional firmware update to the Secure Enclave that disables this delay along with any possible auto-wipe.

All of these options are possible; however, they’d all require Apple to create something specific for the FBI’s use. This reinforces just how good Apple’s security is for their iOS devices. Clearly, Apple has taken security and privacy of its consumers very seriously and should be applauded for that. The value of secure software and system design cannot be over-stated.

Why Your Best Kept Secrets aren't Really Secrets

“I use a FIPS-140 approved cryptographic module, so my communications are safe.” This is a statement we hear quite often and it is true - as long as those communications only need to remain secret for a short time. There is an attack methodology that we are dubbing “Harvest then Decrypt” in which sensitive data is collected and stored today awaiting decryption once quantum computers become available. This attack can potentially expose today’s secrets in a few short years. With the Harvest then Decrypt attack, an outside group records and stores (Harvests) encrypted data that is streaming through the internet or cloud today. This outside group could be storing data to or from a specific website, server, email client, or whatever target they deem worthy of attack. Or, given sufficient motivation and resources, the harvesters could be recording petabytes of data each hour from general internet traffic. Only nation-states would likely embark on this type of mass storage, although it is possible for ISPs and other communication companies to be doing this on a limited basis as well. You might dismiss this as overly paranoid, but there are plenty of publically exposed governmental programs aimed at mass surveillance and data storage. Here are a few examples that have been reported on over the years:

• The NSA’s $1.5 billion Utah Data Center data storage center that is designed to store exabytes (1018 bytes) or more of data. The NSA’s Intelligence-gathering unit called Tailored Access Operations reportedly collects approximately 1 Million Gigabytes of data each hour.
• China’s military hacking unit called APT1 (or Unit 61398 of the People’s Liberation Army) has allegedly hacked into American companies including U.S. Steel, Alcoa, and Westinghouse.
• The British intelligence agency GCHQ has a mass surveillance program called Mastering the Internet (MTI) to capture the content of email messages, social network postings and web browsing history. The UK also has developed the Interception Modernisation Programme to intercept and store communications data in a central database. • The Federal Security Service of Russia has a program called SORM that is already monitoring internet and telephone communications.
• India’s Research and Analysis Wing built the DRDO NETRA which tracks online communications from Skype and Google Talk, among others. India also owns a Central Monitoring System that tracks Google searches, stores e-mails and text messages, monitor posts on social networking services and listens to phone conversations.
• Germany and France have data collection programs called Project 6 and Frenchelon, respectively.

So it is quite feasible that governments around the world are collecting and storing vast amounts of internet traffic. It’s also possible that criminal groups are storing targeted financial data. But if you are using strong encryption, then they probably can’t do anything with that data today.

The threat lies in the fact that quantum computers will be able to break the asymmetric encryption that protect your private keys, giving the outside groups completely unfettered access to your stored data. This is the “Decrypt” part of Harvest then Decrypt. Optimists are predicting that quantum computers will be able to break RSA and Elliptic Curve (the two most popular crypto algorithms) within 5 years, with the consensus opinion being less than 10 years. See my earlier blog for a discussion on who is predicting what.

In 5-10 years, outside parties could have access to your customer account numbers and passwords, your company’s most sensitive IP and internal communications, and any other secrets that you hoped would remain confidential for more than a decade.

If you don’t want this to happen to your data, there are solutions available today that can protect you. If you purchase cryptography, ask your vendor what protections they have (or are planning to offer) against quantum computing attacks. If you build your own encrypted applications, then ask your security team about the actions they are taking.  Your secrets should remain secret for more than the next ten years.

 

Hacker's Ruined my Wife's Valentine's Day

I had an interesting experience when ordering a gift for my wife online at a popular personalized gift store. We love drinking wine, so my plan was to inscribe a set of 6 wine glasses. Like many couples that haven’t hit the 10 year anniversary yet, we have nicknames for each other; and, also like many couples we text each other frequently. I call my wife Babydoll and usually sign off on a text thread with <kiss>. Those of you who know a thing about reflective cross-site scripting can probably see where this is heading.

I start by entering text into the website form field. On the front I wanted Babydoll’s wine and on the back <kiss>. Being in the security field, I wondered how the site would handle a few things in my input:

• Would it strip out the single quote in Babydoll’s wine? Single quote is often used in SQL injection attacks and some websites blacklist the character, much to the chagrin of folks with the last name of O’Reily, O’Mally, et al.
• Would it show me the correct rendering of <kiss> on the “proof” screen? If this is not encoded properly to ensure it’s shown as the text I intend, there’d be a threat of cross-site scripting (XSS). In that case, instead of putting kiss inside those angle brackets, an attacker could put a script command…and rather than displaying the text, the browser would interpret the script and execute the command(s) with potentially damaging consequences.

Below are some screenshots of what the site displayed.

OK, this tells me a couple of things:

1. The site is using an image to reflect my input. That’s good! It avoids the potential XSS I was concerned about.
2. The site accurately displayed my input, single quote and all. So far so good. 

Now let’s take a look at the back…

Interesting…. the site stripped out the angle brackets – even in the image rendering. OK, so maybe their developers know about reflective XSS and decided to avoid all things with angle brackets just to be safe.

But I’m in the application security profession… so I poke around a little, changing a couple of things (all legally of course – one shouldn’t pen test a website without permission since in most countries it’s illegal.)

Perhaps a font change will render something different?...

Sure enough! Certain fonts display the angle brackets and others don’t. Now I’m baffled. Why would this be the case? I decide to ignore the “why” for now and just move on. After all, I need to order my Valentine’s Day present in enough time to pick it up for my wife at the local mall after I place the order online. So I stick with the font that displays the <kiss> and move on to checkout.

 

 

 

I proceed, happy that the site has gotten it right (or at least right enough for me.) Here’s my confirmation screen with all the correct info:

 

In stock and ready to be picked up in plenty of time for Valentine’s Day. At least this year I won’t be in the proverbial dog house!

I’m traveling the week the glasses will be ready, so I send my niece to pick them up. I ask her to check them before she leaves the store because I’m still skeptical they’ll come out alright. She reviews them and leaves the store, satisfied they are correct.

Here’s where things get a little wonky….

When I bring the box home and open them up, I find that the engraving on the front of the glass is perfect; however, on the back this is what is on all 6 glasses:

Naturally, I’m disappointed with the engraving; but I’m also curious – what the heck is that character?

My wife works in the security field, too, so I decide to show her the glasses ahead of time and move on to a different Valentine’s Day gift. She finds the matter as humorous as I do, thankfully…but now of course I need to find another gift!

Unsatisfied that I understand what’s going on, I return to the site to test a few more things. Would other special characters produce funky results (even on-screen)?

Indeed they do! Here’s one such screen shot:

 

 

 

I put <Love> into the text box, then I tried escaping the ">" with a backslash. The web application is doing  something with this input, though I’m not sure what. I ask one of our engineers and his best guess is that “par” might be “parse error” truncated, a variable name, or some other mangled interpretation of the parameter encoding and sanitization that the developer tried to put in place for user input.

This experience leaves me with a few interesting observations:

• Kudos to this website’s developers for at least doing something toward sanitizing user input. They clearly didn’t get it all right, but at least they’re thinking defensively, which is a good start! But they’ve got some business logic issues between the client and server side of their personalization website because the order confirmation showed me exactly what I expected but the resulting engraving didn’t match.
• Could this website have implemented defensive coding measures better so that it was still secure but didn’t negatively impact functionality? I’m sure the answer to this is yes… there are known best practices for input sanitization and output encoding that probably should have been implemented. 
• There is something missing with this website’s quality assurance testing. I’m guessing the security and quality testing activities are segregated, with little communication between the two.
• I also would have loved for the store itself to verify that the order placed online is the same as what was produced (clearly this was not the case here.) With a simple comparison between the order confirmation screen (and email they sent me of the same) and the end product, it would have been clear that the wrong inscription was put on the glasses.

If you have any further thoughts on this (or an idea for my wife's Valentine's Day gift), please let me know!

Finding the Right Mix of Automated and Manual Security Testing

We’re familiar with the cliché, “If your only tool is a hammer, then every problem looks like a nail.” Because software is so complex and there is no single solution to
adequately conduct comprehensive software security testing, it’s important to make sure our testing toolboxes have more than one tool.

The toolbox metaphor is quite apt: your physical toolbox contains several types of screwdrivers of varying sizes since screws come in different types and sizes. Using a Philips screwdriver on a Torx screw does not work effectively. Using the right tool for the job can mean the difference between success and failure.

We live in a tool-centric world where there is a natural tendency to use automation to help us work more efficiently. Automation enables us to handle repetitive tasks with ease. It helps avoid the tedium of dealing with mundane tasks, and it can dramatically speed up doing those repetitive, mundane tasks and can do them consistently.

Which Tools to Use and When

Automated tools can really help with software security testing, particularly when there is a lot to test and even while coding. Organizations that tend to rely exclusively on automated software testing is a case of having just a hammer. Automated software testing alone can’t provide the deep testing coverage organization’s need to find deeply rooted, business logic and compound vulnerabilities. Additionally, automated software testing often struggles on complex systems with technologies such as Ajax, Flash, Silverlight. In these cases, manual testing will pick up where automated tools left off and get you both the broad and deep testing coverage you need.

A balanced security testing approach uses automated testing to look for the obvious issues that automated security testing does so well at. Manual testing can fill in the gaps for those areas that need extra scrutiny (security-sensitive functions) and those areas that can’t be effectively tested with automated solutions.

Manual security testing does a good job of weeding out false positives, and can be used to show how several lower risk security defects can be chained together to create a successful breach. Some people feel that the medium and lower risk security defects aren’t that critical; however, it is common for hackers to chain them together into one massive attack – a situation that only manual testing can simulate. Manual testing excels at finding business logic errors because humans are better at understanding complex workflows and business logic than automated tools. And it is necessary for a human to look closely (thoroughly test) high-value and security-sensitive parts of the application.

Using the right tool for the job really makes a difference. Make sure your application security toolbox includes the right balance of automated and manual testing for complete testing coverage.

It's Data Privacy Day! Here's 4 Tips for Keeping Your Data Private at Work.

The strongest defense against threats to an organization's data includes security controls, which focus on a main objective of proper security implementation in support of data privacy. These safeguards are used to avoid, detect, and prevent unauthorized access to your organization's facility – protecting your employees and company information. Controls help reduce the risk of damage or loss by stopping, deterring, or slowing down an attack against an asset.

These controls are categorized into three main areas, and include physical (eg. security camera), technical (eg. network authentication), and administrative (eg. training and awareness). While the company can implement these controls, every employee must be held responsible to adhere to the established rules and report any suspicious activity. 

As Data Privacy Day Champions, today we're focusing on bringing awareness to data privacy in the workplace and incorporating security controls to prevent potential threats from retrieving private data. Here are four quick tips to help you do your part in protecting your organization against security threats.

1. Keep your office secure

• Lock your computer screen
• Put sensitive files into locked cabinets
• Shred documents when you are finished with them
• Use a laptop lock at your desk
• Do not leave your mobile device unattended
• Erase your white board each day
• Do not store passwords in any physical location

2. Keep the conference room clean

• Gather and destroy any sensitive handouts
• Erase white boards
• Log off of the computer

3. Keep the shared printer area clear 

• Use a password when printing sensitive data
• Collect all sensitive printouts and dispose of them securely when finished with them
• Don’t leave originals on the printer or copier

4. Rules must be defined and enforced

• Limit access to any area storing private information (file rooms, server rooms, etc.) and monitor access to these areas
• Ensure cabinets remain locked at all times
• Possibly deter intrusion with surveillance equipment or badge entry

Proper implementation of these security measures can go a long way in preventing unwanted people from breaching your organization. to maintain effectiveness, it's suggested to continuously remind your employees about the importance of security and require them to take part in a security awareness program within your organization.

Interested in implementing a security awareness program at work? To celebrate Data Privacy Day, we're offering a free trial of our security awareness training program and a sneak peek at some materials for our new course on Data Privacy!

When will Quantum Computers Arrive?

If you have been following my blogs over the past few months, you’ll know there has been a flurry of activity around quantum computing. An overwhelming consensus now exists that quantum computers of sufficient strength to break RSA and Elliptic Curve (ECC) are going to be available in the foreseeable future. But exactly when will quantum computers be available? Nobody knows for sure, but here are some observations that may help you draw your own conclusions.

The news that first made many people aware of quantum computing’s looming threat on cryptography was the NSA announcement on August 2015, in which they broadcast preliminary plans for transitioning to quantum resistant algorithms. The NSA did not include any dates as to when organizations should transition, but they were clear that no new effort should be spent switching from RSA to ECC. One could infer from this that the recommended evolution to quantum resistant crypto should take place sooner rather than later.

The second clue comes from the European Telecommunications Standards Institute (ETSI) who now predict a less than 10 year horizon in its June 2015 Whitepaper, which stated, “if the organization has a need to archive certain information or protect the privacy of online transactions for more than 10 years, and currently uses encryption techniques, then these security methods should be upgraded to known quantum safe algorithms and techniques in order to protect long-term privacy.”

And in October 2015, Microsoft agreed with the ETSI prediction, saying that “practical” quantum computers should be available within 10 years.

The European Commission PQCRYPTO project also concurred, issuing a press release that said, “The expectation is that large quantum computers will be built sometime after 2025.”

In July, at the ISC 2015 supercomputing conference, Vadim Smelyanskiy, a Google scholar working on quantum computing was even more aggressive, stating that by improving error correction, a powerful quantum computer could become available sometime between 2020 and 2025.

So the NSA, European Commission, Microsoft, ETSI and Google all seem to agree that the horizon for large scale quantum computers capable of breaking today’s cryptographic algorithms is between 2020 at the early stage and after 2025 on the more conservative side. Of course this does not take into account potential advancements made by the US Department of Defense or FBI, the UK GCHQ, China’s Ministry of State Security or Russia’s Foreign Intelligence Service, none of which will be issuing press releases when they have working quantum computers.

You may conclude that you have another 5 years before you need to worry about this quantum computing problem. Even if your organization were capable of making an immediate decision to switch to a quantum resistant algorithm and replace it quickly (which is much, much harder than one might expect) – waiting 5 years is far too late.

There is an attack methodology known as Harvest & Decrypt, in which sensitive data is collected and stored today and decrypted once quantum computers become available. This attack can potentially make all of our current secrets available in a few years. I’ll discuss this possible attack in detail in my next post.

Six Ways to Improve Your Organization's Mobile Security

Remember the days when you were handed a BlackBerry on your first day of work? In today's connected world, there's little need for most organizations to spend the money on handing out phones to everyone in the office, as most people these days already have smartphones capable of doing everything needed. This new policy is known as BYOD (Bring Your Own Device).

Mobile security is increasingly important for organizations to address, as the BYOD  trend blurs the line between personal and company data. A staggering 84% of mobile users use the same smartphone for business and personal use. This means anyone accessing the internet from their mobile phone or connecting with home and work networks is putting both their personal and their organization's information at risk.

Today I’m looking at three common mobile security breaches and offering six actionable ways to improve your organization’s mobile security.

Three Common Mobile Security Breaches

1) Device Loss and Theft

The most common mobile security “breach” is caused by lost and stolen devices. Leaving your phone in the back of a taxi after a night out is suddenly much more serious if it’s your work and personal phone. A lost or stolen device could put your company data at risk if you don't have good mobile security practices in place.

2) Malware

Malware (the unintentional installation of malicious software) is one of the most common security threats faced by organizations. Malware could take over a phone’s connection, send spam emails, infect other devices, or harvest passwords. Approximately 42% of smartphone users store password and login information within apps on their phones, so a mobile breach would pose a real threat to your organization’s information security should attackers be able to harvest this information.

3) Unsecured Networks

Another danger is the rogue WiFi network. This network will look like a normal network (for example with the same name as the one in your local coffee shop), but in reality has been created by a hacker. Once you use the network, the hacker monitors all your activity and attempts to capture sensitive data like passwords and bank account details. 

Six Ways to Improve Mobile Security

As you can see, it's not extremely difficult for someone to hack into a mobile device. In many instances, we're inviting them to steal data if we don't properly secure the device to begin with. As more businesses are adopting this BYOD method, it's important to make sure employees proceed with caution and understand the risks of using their mobile devices for work. Luckily, there are a few simple things you can encourage employees to do if they choose to use their mobile devices for both business and personal use. 

1) Use A Lock Screen

It's reported 62% of smartphone users don’t use a password to secure their device. Passwords are the first line of defense against unauthorized access to your phone’s data, so it’s imperative that you follow password best practices to keep your organization's data secure. Using a lock screen and setting your device's security can go a long way in stopping a potential thief from stealing your data. There are a variety of ways to secure your mobile device, including patterns, pin numbers,  and standard passwords using letters, numbers, and symbols. Advanced phones now come with fingerprint scanners, facial recognition, and even voice recognition. When setting up your lock screen, follow standard password best practices and don't make it easy for hackers to guess your password.

2) Install Anti-Malware Software

Mobile operating systems are becoming increasingly popular targets for malware, so if you’re using your phone to access the internet, you should install anti-malware software on your device – and keep it updated. This will help to keep your personal and company data safe from malware attacks.

3) Choose Mobile Applications Carefully

When you’re downloading software for your desktop computer, no doubt you’re careful to only download from reputable and secure sources, so why would you take risks when downloading apps for your smartphone? Not all applications are created to the same standards of security. Installing rogue or insecure software even on just a single device can compromise your entire organization’s information security. For this reason, think twice before you install something on your phone. You're not only putting your personal data at risk, but your organization as well.

4) Avoid Unsecured WiFi

It’s important employees know to treat WiFi access with caution so they’re not putting your company’s data at risk. This is particularly relevant to employees who work remotely, who may choose to work from a local coffee shop, or who log on to public WiFi when traveling. Equally, if you’re using the same smartphone for work and personal communication, connecting to the WiFi while you’re out shopping or in a restaurant on the weekend is still a potential security risk to your organization. Employees should ensure their phones don’t automatically connect to WiFi networks, and if possible opt for unlimited data contracts so they don’t need to rely on WiFi.

5) Encrypt Sensitive Mobile Communication

Most experts recommend all mobile communications be encrypted because wireless communications are so easy to intercept. Employees accessing company data from outside of the office should use a virtual private network (VPN) to protect and secure their communications.

6) Create a BYOD Policy

BYOD can offer a number of benefits to organizations, such as lower hardware costs and giving employees greater flexibility in terms of their working hours. However, this is at the expense of your organization’s security. To address the security problems associated with BYOD working, it’s essential that your organization has in place a BYOD policy, outlining the procedures employees need to follow to secure their devices. In the event an employee does lose a phone, there should be an emergency policy in place that will allow you to remotely wipe the phone data if needed.

Mobile device security is only one way to help further protect your organization from online threats. You may want to begin thinking about implementing an organization-wide security awareness plan to educate you employees and download the Essential Guide to Online Security to learn about securing your social media networks, laptop computers, emails, and more.

 

2015: The Year the World Became Aware of Car Hacking

Security Innovation has been securing Vehicle-to-Vehicle communications for almost 10 years, but for the average consumer, car hacking only came to light in 2015. As the year draws to an end, here’s a look at some of the events in 2015 that made car hacking go mainstream. January A researcher discovered that he could hack into the onboard networks of certain automobiles by exploiting Progressive’s Snapshot driver tracking tool which plugs into the highly-vulnerable OBD-II port. February 60 Minutes featured a segment on DARPA hacking the steering, braking, horn, acceleration, etc. This was immediately followed by US Senator Ed Markey’s report Tracking & Hacking: Security & Privacy Gaps Put American Drivers at Risk which highlighted that automakers have not protected cars from hacker infiltration into vehicle systems nor have they protected drivers’ privacy. By utilizing a Wi-Fi dongle plugged into the OBD-II port, a researcher

January

A researcher discovered that he could hack into the onboard networks of certain automobiles by exploiting Progressive’s Snapshot driver tracking tool which plugs into the highly-vulnerable OBD-II port.

A researcher discovered that he could hack into the onboard networks of certain automobiles by exploiting Progressive’s Snapshot driver tracking tool which plugs into the highly-vulnerable OBD-II port.

February

60 Minutes featured a segment on DARPA hacking the steering, braking, horn, acceleration, etc. This was immediately followed by US Senator Ed Markey’s report Tracking & Hacking: Security & Privacy Gaps Put American Drivers at Risk which highlighted that automakers have not protected cars from hacker infiltration into vehicle systems nor have they protected drivers’ privacy.

By utilizing a Wi-Fi dongle plugged into the OBD-II port, a researcher let an NBC NY news team use their laptop computer to control the headlights and wipers of his Mazda parked in Seattle.

March

A class action lawsuit in California claimed that Ford, Toyota and General Motors knowingly put consumers at risk by selling connected cars that can be hacked remotely. A former Tesla intern released a $60 fully Open Source car hacking kit that gives hobbyists (and hackers) a cheap and easy way to gain access to the CAN network of their connected cars. April Nick Bilton, a columnist for the New York Times, saw two kids unlock his Toyota Prius electronically, which he thinks was done by amplifying the signal from his keyless entry fob to his car. Keyless entry systems typically only communicate with their remote

April

Nick Bilton, a columnist for the New York Times, saw two kids unlock his Toyota Prius electronically, which he thinks was done by amplifying the signal from his keyless entry fob to his car. Keyless entry systems typically only communicate with their remote

Nick Bilton, a columnist for the New York Times, saw two kids unlock his Toyota Prius electronically, which he thinks was done by amplifying the signal from his keyless entry fob to his car. Keyless entry systems typically only communicate with their remote fobs over the distance of a few feet, but a signal amplifier is capable of extending this range, fooling the car into thinking that the remote is nearby even though it was in Bilton's House, about 50 feet away. Other theories were that his key fob was cloned by an insider at a repair shop or that the teens used a frequency jammer to keep the car from ever being locked. Regardless of the real attack, this article received a lot of attention. 

May

Legislators from the US House Committee on Energy and Commerce wrote letters to 17 automakers and the National Highway Traffic Safety Administration asking each about their cyber security readiness. The Committee said “Threats and vulnerabilities in vehicle systems may be inevitable, but we cannot allow this to undermine the potential benefits of these technologies. The industry and NHTSA have an opportunity to prepare for the challenges that advanced vehicle technologies present, and to develop strategies to mitigate the risks.”

In an email blast to over 1 Million subscribers, Consumer Reports urged its members to write congress requesting more government-mandated security for car-based computer systems. Consumer Reports provided an electronic form letter that can be automatically sent to the appropriate legislator.

June

Apparently, hackers and legislators took the month off and went to the beach, as there was no car hacking news this month.

July

US Senators Markey and Blumenthal introduced the SPY Car Act to protect drivers from hackers and protect their privacy. This legislation was announced immediately after researchers demonstrated that Chryslers could be remotely hacked, which prompted a Fiat Chrysler recall of 1.4 Million vehicles.

By this point that the average person was now aware of the threat. According to a Kelley Blue Book survey, almost 80% of consumers thought that vehicle hacking would be a frequent problem in the near future. But the hacking didn’t stop in July.

August

Frost & Sullivan released a report Automakers Remain Passive as Government Takes Action which criticized the steps that automakers had taken on cybersecurity and concluded that their inaction forced the US Government to intervene.

Researchers from the University of California at San Diego demonstrated that they could hack the brakes of a 2013 Corvette via the Metromile insurance dongle, which plugs into the OBD-II.

That same month, a UK court ruled in favor of researchers, allowing them to release their research on a vulnerability in the Radio-Frequency Identification (RFID) transponder chip used in immobilizers of VW cars. VW had been trying to suppress the research for two years, even though thieves were actively using this hack to steal cars in London.

September

Security Innovation’s own researcher, Jonathan Petit, showed LiDAR and cameras used by autonomous vehicles could be spoofed or temporarily disabled using lasers. Also, researchers at the University of California at San Diego and the University of Washington revealed that they could remotely take over a 2009 Chevy Impala. It took GM 5 years to fix this vulnerability, which was quietly brought to their attention by the researchers in 2010.

US Senators Richard Blumenthal of Connecticut and Edward Markey of Massachusetts were at it again, this time sending letters to 18 car makers asking for updates on how they protect vehicle owners against the threat of cyberattacks or unwarranted invasions of privacy. These letters were follow-up to the questions these senators asked the car makers in 2013.

October

A Ponemon Institute survey of over 500 automakers regarding cyber security showed that the car manufacturers and suppliers were not treating security as a priority, nor did they believe they had the skills or knowledge to make a car nearly hack-proof.

The US House Energy and Commerce Subcommittee on Commerce, Manufacturing, and Trade released a staff drafted proposal which addressed automotive cybersecurity and privacy.

US Representative Wilson also introduced the SPY Car Study Act of 2015 proposed that the National Highway Traffic Safety Administration (NHTSA) be directed to conduct a study to determine appropriate cyber security standards for motor vehicles.

The Librarian of Congress recently announced exemptions to the Digital Millennium Copyright Act (DMCA) that now make it legal to hack your own car without permission from the automaker.

November

An episode of CSI: Cyber called “Gone in Six Seconds,” was about a hacker who remotely controlled and crashed a driverless car using an open source microcontroller connected to its OBD-II diagnostic system.

 

December

SAE International produced a webinar called “J3061™ – The World’s First Standard on Automotive Cybersecurity A Global Discussion.” The J3061 will provide a cyber security framework for car makers and their suppliers.

Thankfully, there were no known cyber-attacks in 2015 that caused crashes, injuries or deaths. But as more and more connected features are added to cars each year without a corresponding increase in security, we may not continue to have such good fortune. If you’d like to read more about any of these topics, I compile a comprehensive list of automotive security articles that can be found here.

 

The Cryptopocalypse is Nigh - The Threat of Quantum Computing

If you have been following any of my posts over the past few months, you'll already know that there have been a flurry of recent quantum computing and quantum-resistant cryptography announcements from the NSA, Google, and IBM, to name a few.  

You can now add Kaspersky Lab to the list of companies warning against the impending threat of quantum computers on today's cryptography.  In the Kaspersky Security Bulletin 2015, they warn that "The cryptopocalypse is nigh."  They go onto say that progress in quantum computing "signals a
breakdown in the reliability of current crypto-standards and a need to
design and implement ‘post-quantum cryptography’."

It's not to say that the common hacker will have a quantum computer capable of breaking RSA and ECC tomorrow, but enough progress has been made that it's not out of the realm of possibility that nation-states could have access to the technology before many companies can implement counter-measures.  Luckily, there are quantum-resistant algorithms, including NTRU, which are available today.  Implementing new crypto takes significant effort, so the time to work on this is now.

If you'd like to learn more about quantum computing and how it can render your crypto solutions useless, exposing all of your secrets, check out Security Innovation's webcast The NSA and the Quantum Computing Threat.  

Six Holiday Tips For Staying Safe Online

The holiday season is a time we often use to spend with family and friends. Unfortunately, for many of us, leading up to the holiday can be a hassle. Between online shopping for presents and traveling to see family, this time of year is busy and online security is usually the last thing on our minds. According to a recent survey conducted by retail research firm Conlumino, nearly 68 percent of shoppers this holiday season plan to do at least some of their holiday shopping online. In addition, approximately 70 percent of these people plan to do some of their shopping on company time. This puts not only the shopper at risk for an attack, but the company as well. Attackers prey on shoppers who are uneducated about common threat trends and companies that don’t properly secure their data. Busy airports and highway rest stops are also a strong target, as many people willingly connect to public WiF to answer emails, access social media, and even work information. Luckily, by following a few simple tips, you can help protect yourself from potential online threats.

Here are six tips to help keep yourself (and your company) safe online this holiday season:

1. Beware of Phishing Attempts. Phishing emails are one of the most common ways for thieves to collect data. If you’re reading emails at work, you’ll also put your company at risk as well. If you receive an email about a deal that sounds too good to be true, it probably is. Do some research to make sure it’s a real company promotion before you proceed. Also scan the email for the “From” address and check that the URL is where you’d expect it to go. Common holiday phishing scams may include charity scams, package delivery notices, and e-greeting cards from people you may even know.
2. Use Unique Passwords for Shopping Sites. In the event of a data breach, hackers will use the stolen data and try to infiltrate other websites. For this reason, it’s always recommended every website have a unique password and that you keep these passwords secure in a password manager. If the online retailer supports 2FA (Amazon is one of them), enable this for extra protection as well.
3. Ensure your Traffic is Encrypted. A study from Experian shows 40 percent of those who shop online don’t check to see if the traffic to the website is securely transmitted before buying. Look for websites using “HTTPS” instead of just “HTTP,” use an ad-blocker to help reduce malicious ads, and remember to log out of your account when you’re done shopping.
4. Travel Smart. Many of us hop on a plane or drive somewhere for the holiday season. If you’re at the airport, hotel, coffee shop, or anywhere not your home you are likely connecting to public WiFi. Make sure your device isn’t set to “Automatically Connect to WiFi” and avoid checking emails, accessing bank account information, and posting to social media on public WiFi.
5. Keep Sensitive Information Out of Social Updates. Many of us choose to share our holiday experiences on social media, especially to stay in touch with family. By posting your location on social networks, thieves will notice you’re out of town and may stop by your home for an unexpected visit. Set your account to only share information with people you’re connected to, and only connect with people you know and trust. M make sure your photos don’t share any sensitive information, intentionally or not.
6. Secure your Mobile Devices. Apps can help keep the holiday season organized, from travel accommodations to retail apps that make online shopping easier. However, apps can be vulnerable to attacks as well. Only download apps from trusted parties and read the reviews before downloading. If your device is ever lost or stolen while traveling over the holidays all of the data could be exposed. To protect yourself enable and test out the find my phone features before your trip and be sure to apply a strong password/pattern to your phone to protect the data.

Many successful schemes are carried out by phishing attempts, social media websites, hijacked internet searches, fake advertisements, and phony holiday offers. The holiday season is often stressful enough for many of us. Simply being aware these threats exist can go a long way in helping you stay secure online.