Joe Harris
-
Posts
1,048 -
Joined
-
Last visited
-
Days Won
7
Content Type
Profiles
Forums
Events
Downloads
Gallery
Blogs
Blog Comments posted by Joe Harris
-
-
-
@ Chris - I am talking about other interfaces on the device - not signalling or polling. Where are the regulatory controls for web servers built into devices etc...
@ Carl - The point highlighted is that this exploitation of a consumer device is a mirror for potential exploitation of non-consumer devices.
The only reason that this is not happening in our industry is through less exposure and obscurity. As equipment is replaced and things end up in the hands of curious members of the public then we will very possibly end up with a similar exploit affecting equipment we all use.
A 'hack' or exploit affecting old machines may be inherited by newer firmware also (they rarely go back to the drawing board) so do not think that up to date hardware or firmware will resolve the issue unless the specific flaw is fixed.
This occurred because so many people had access to the device and one person got curious and a manufacturer was lazy in their coding. A function probably used for test purposes was left in the official firmware release of a product.
I have reviewed some 'professional' equipment code already and I have to tell you now, it is often spaghetti code (in other words put together to make it work but not efficient / clean / organised code).
There are no standards on device access through other interfaces and developer counts in manufacturers are low as price pressure hits.
When time is money code is rushed.
We need to be pro-active in ensuring that our industry does not end up with egg on its face through a lack of controls.
-
You can still access the lists and local devices can still be shown via sites like Shodan (Swap happyland for the city of your choice - or remove it for full gb listing)
Also there are pastebin listings of devices and other websites like cryptogasm showcasing connected devices.
The point about heitel is basically what I am trying to convey in the article.
This exploit was discovered as trendnet devices were widely deployed and a user was experimenting with bypassing security measures. The user posted details on his blog as he was as suprised as anybody else at how easy it was to bypass all password security by affixing a simple string to the end of the url to access a script within a folder hosted on the devicem or by feeding a string of data that was too long as one off the variables (sFilter)
The worrying side of things which I did not want to add to the original blog post was that due to a lack of 3rd party accreditation the only reason we have not seen more exploits in commercial / professional devices is down to obscurity. Which is never a long standing defense particularly in these days of ebay sold second hand items.
Do you think that professional security devices will be more securely coded than mass produced consumer devices? From the speghetti code I have seen on some devices so far I do not think that is the case.
A lack of resources at manufacturer level and no 3rd party pen testing tells me that it is only a matter of time.
-
Early indications from Apple and Samsung are that they intend to utilise AR in the next 12 months to provide 'meta data' primarily, such as help, guides and additional information to allow a more uncluttered main display without this extra information.
It seems like this will be a popular route for integrating this type of technology.
How will this fit in with your products and service offerings? -
Current regulations prevent it, but those regulations are under review right now.
Police forces have been using these actively for more than 5 years now and in built up areas.
The fact is that some of the previous restrictions were based on technical limitations which have now been overcome by technological breakthroughs which have come into place so the CAA and government have to now reconsider if the restrictions are appropriate and if the controls are adequately regulated to ensure that members of the public are not impacted upon or their privacy invaded by unregulated or unlawful users.
It would be better for us all if a suitable framework could be implemented for us to follow if it were to take off (sorry for the pun...)
-
http://www.computerweekly.com/news/2240175468/UK-to-launch-public-cyber-security-awareness-campaign
93% of large corporations and 76% of small businesses experienced a cyber security breach in 2012
-
Have you considered the potential impact and risk exposure of your accounting software?
Do you take stateful snapshot backups which can be queried in a standalone format as well as provably restorable on demand?
-
http://www.professionalsecurity.co.uk/news/training/espionage-films/
UK seen as a priority target for espionage
-
Hah - Yes it is MrHappy
To test it out yourself take a peek at Aurasma Lite on iphone or Android for a quick test of what can be done directly from a phone to set this type of thing up.
This can be based on specific graphics or specific geolocation. I think they have a 3D shark you can use as a test
-
James,
You are spot on and as mentioned existing 'old style' PSTN comms can be affected just as much as 'new style' IP / GPRS connectivity.
There are a number of methods that would be effective against ARCs though I see some ARCs beginning to implement counteractive measures as a form of target hardening.
Forward thinking ARCs are ensuring as much redundancy as is feasible and structuring their systems to ensure that such a threat is minimised.
The only sad part is that for each ARC that does approach things this way, twice as many will bury their heads.
As for false signals vs outright bandwidth flooding - The former may be more effective initially as it will form shaped traffic more likely to pass through any initial early stage filtration. The issue will be (as it is for unrelated websites usually) how to distinguish genuine traffic from spoofed traffic and to ensure that this is carried out with zero latency and zero errors.
A tough ask.
Joe
-
With standardised chargers now being implemented for mobiles and the "optimal" phone designs now settling in, I would like to see a system where my phone docks into a cradle to form the keypad / home control unit or docks in my vehicle dash when out and about to act as my satnav etc.
These things are possible already but I want a more seamless and intuitive integration that just works.
Once you remove the shackles of sticking to conventions and assuming that the old way was always the right way you can really start to explore truly ergonomic solutions.
The only thing to be careful of is that not all change is good change - so research carefully and test fully.
P.S. - Trifactor authentication based on:- Physical device (Phone)
- Code entry (Keypad displays on insertion into dock)
- Iris / facial recognition (Using camera built into phone)
Could be a useful way to provide further authentication without requiring a lot of time or equipment which could work for several applications.
-
An excellent summary and analysis thanks Chris.
-
Enjoyable read Jim, echoes a great deal of that which I have seen recently in industry.
Thanks for taking the time and I look forward to the next article.
'J
Drone Verification - Coming Soon?...
in Electronic Security & Technology
A blog by Joe Harris in General
Posted
http://www.professionalsecurity.co.uk/products/cctv/drone-on-show-3/