Monday, 27 July 2015
HP Fortify finds 100% of tested smartwatches contain significant security vulns
By StephanieWisdom (HP)
Smartwatches—they’re growing in popularity for both their convenience and capabilities (plus, they look pretty cool). But, as they become more mainstream, they’ll continue to store more sensitive information, and through connectivity with mobile applications, they may soon enable physical access functions—unlocking cars and homes. It truly is the era of Internet of Things (IoT).
As part of an ongoing series looking at IoT security, HP has unveiled results of a recent study which confirms that smartwatches with network and communication functionality represent a new and open frontier for cyberattack. The study conducted by HP Fortify found that 100 percent of the tested smartwatches contained significant vulnerabilities, including insufficient authentication, lack of encryption and privacy concerns.
The study questions whether smartwatches are designed to store and protect the sensitive data and tasks for which they are built. HP Fortify on Demand assessed 10 smartwatches, along with their Android and iOS cloud and mobile application components, uncovering numerous security concerns.
You can read the report here, as well as see actionable recommendations for secure smartwatch development and use—both at home and in the office!
View the original content and more from this author here: http://ift.tt/1et5i1T
from hacker samurai http://ift.tt/1D5nw5r
via IFTTT
Hackers remotely turn off engine and jam brakes of car
A leading security company claims data can be sent to a car through Digital Audio Broadcasting (DAB) radio signals, which then mines its way into the car’s computer system and gives the hackers remote access to its key systems, including braking and steering.
NCC Group revealed the exploit on the same day that two US researchers were reported to have taken remote control of a Jeep Cherokee (with the driver’s permission) and applied the brakes without having any previous physical contact with the vehicle. Chrysler has released a software update to address the problem.
Manchester-based NCC Group revealed its findings to the BBC, and explained how it had carried out the hack using relatively cheap, off-the-shelf components connected to a laptop.
Researcher Andy Davis created a DAB station, which a car would be able to connect to through its radio; because DAB stations can send text and pictures to a car’s dashboard screen, an attacker can bundle malicious code with these to gain control of the system.
Taking control of the steering and brakes
Once the attacker has compromised the dashboard and entertainment system, Mr Davis claimed they could then work their way into the car’s critical systems, such as steering and braking.
A more powerful transmitter could let attacks target several vehicles at once, the researcher claims. He also described how attackers could broadcast over the top of existing stations to target as many vehicles as possible.
According to him, “As this is a broadcast medium, if you had a vulnerability within a certain infotainment system in a certain manufacturer’s vehicle, by sending one stream of data, you could attack many cars simultaneously. [The attacker] would probably choose a common radio station to broadcast over the top to make sure they reached the maximum number of target vehicles.”
Modern cars are targets
Modern cars are increasingly becoming targets for cyber attacks due to their expanding roster of autonomous features.
Automatic parking is an option in a number of mid-range cars and gives the vehicle’s computer control of the steering, while automatic braking to avoid low-speed accidents in traffic is also fitted to many others, even at the lower end of the market; cruise control can be used to adjust a car’s speed without a physical connection between the driver and the engine.
If all three systems are compromised on an automatic car (wherein the driver cannot press the clutch pedal to stop the engine engaging the gears), then hackers can potentially gain full control of the vehicle.
“If some persons were able to compromise the infotainment system because of the architecture of its vehicle network, they would in some cases be able to disable the automatic braking functionality.”
He admitted that the hack would take “a lot of time, skill and money” but warned that this “isn’t to say that there aren’t large organisations interested in it.”
View the original content and more from this author here: http://ift.tt/1LMLV2F
from hacker samurai http://ift.tt/1LMLOUO
via IFTTT
Subscribe to:
Posts (Atom)