Posts Tagged ‘Hacker’

Ford calls in the hackers

February 20th, 2012

AN army of computer nerds will soon play a big part in how you interact with the car.

Ford is poised to seek help from the most unlikely of sources – computer hackers – to develop the next killer iPhone-style in-car application.

OpenXC, as the free software is known, is expected to be released to the hacker community in the next few weeks, starting with the digital framework for a future version of the Ford Focus.

To help them further, Ford has even provided details of the hardware the hackers will use to build the modules, based on a $30 kit available from computer specialty shops.

According to Ford, the software imagines a time when ”your car is as easy to program as your smartphone”.

”A simple start is to take advantage of the GPS antenna on the roof of the car to improve the accuracy of your location-aware application,” Ford says.

”Or get creative – why not generate a digital painting based on your steering wheel movements during the course of a day, and upload it directly to the web.”

Ford says there is growing interest in the community to connect the output from a car’s systems to so-called ”third-party” applications – software that is not made by the car maker – and the internet.

”Many companies are already offering tools to hook into the driver’s interface, but for the most part they have limited availability for hobbyists and developers,” it says.

”What if the system was designed from the ground up to be open-source and to give insight into the vehicle itself?”

John Ferlito, the president of software interest group Linux Australia, says Ford’s decision to release the software for anyone interested in having a go at developing new apps – as well as releasing it for free – is a good move.

”It’s a really great thing that they’ve made sure that there’s no barriers to entry for this,” he says.

”You will be able to just buy a bit of hardware, plug it into the car and see things like the fuel economy on your phone.

”Having a platform like this also makes it easy to use your own satellite navigation system to make a head-up display [where images projected on the windscreen appear to ''float'' in the air in front of the driver]. It will be easy to play and talk with the system.”

However, Ferlito sees even more functionality possible, particularly if the car is integrated with the home.

”Someone will invent one good doo-dad and you will be able to drive home and your house will automatically unlock when you get near the driveway,” he says.

”If that’s the sort of stuff people can make, then that’s a really great thing.”

Source:http://www.caboolturenews.com.au/story/2012/02/20/ford-calls-hackers/

Hackers, IT units focusing on smartphone security

January 2nd, 2012

Mobile phones, long seen as safe amid rising threats to computer security, have become a key target for hackers and an increasing worry for corporate IT departments.

While the first mobile virus dates back to June 2004, risks from hackers remained limited because of the relatively small size of the market.

Source:http://articles.economictimes.indiatimes.com/2011-12-30/news/30572944_1_mobile-security-mobile-phones-mobile-devices

Student Hackers and a Dose of Skepticism Secure Vital Hardware

November 9th, 2011

New design techniques to protect vulnerable hardware from malicious manufacturing flaws have been developed by researchers at Polytechnic Institute of New York University (NYU-Poly) and the University of Connecticut with some help from the crowd.

Ramesh Karri, NYU-Poly professor of electrical and computer engineering, explains that most engineers design systems under the assumption that the underlying hardware is trustworthy; in other words, free of malicious elements. That assumption, he says, is false.

In May 2010, for example, the FBI’s Operation Network Raider seized more than 700 pieces of counterfeit Cisco network hardware and labels with an estimated retail value of more than $143 million. While that scheme was likely conceived for financial gain, designers of integrated circuits, or microchips, also need to protect military, financial, transportation and other critical digital infrastructure from Trojans inserted by intruders with other criminal or military intentions. Like the Trojan horses of Greek mythology, cyber Trojans appear to be harmless but instead steal information or harm a system once it is in operation.

Karri and researchers from the University of Connecticut developed new techniques that designers can use to defend against weaknesses in the supply chain, which typically includes an overseas manufacturer and often stretches across the globe. Their new “design for trust” techniques update the well established “design for manufacturability” and “design for testability” mantras. They were outlined in two IEEE Computer Magazine articles, “Trustworthy Hardware: Trojan Detection and Design-for-Trust Challenges,” and “Trustworthy Hardware: Identifying and Classifying Hardware Trojans.”

“The ‘design for trust’ techniques build on existing design and testing methods,” explains Karri.

One such technique involves ring oscillators, which are sets of odd numbered, inverting logic gates that designers use to ensure an integrated circuit’s reliability. Circuits with ring oscillators produce specific frequencies based on the arrangement of ring oscillators. Trojans alter the original design’s frequencies and alert testers to a compromised circuit. However, sophisticated criminals could account for the frequency change in their Trojan design and implementation. Karri and his team suggest designers thwart their tactics by creating more variants of ring oscillator arrangements than criminals can keep track of, making it harder for them to implant a Trojan without testers detecting it.

Unlike microbiologists with relatively easy access to sample viruses, Karri and other hardware security researchers cannot study ample real-world Trojans because companies and governments are reluctant to share infected hardware for reasons of intellectual property, national security or fear of embarrassment. So Karri and his colleagues turned to the crowd to collect sample Trojans that informed their design-for-trust techniques.

Graduate and undergraduate students from across the country build and detect hardware Trojans for the Embedded Systems Challenge, part of NYU-Poly’s annual Cyber Security Awareness Week (CSAW) white-hat hacking competition. Karri and his team analyzed a diverse collection of 58 submissions from the 2008 competition and developed a taxonomy that is helping to standardize metrics for evaluating Trojans.

Crowdsourcing Trojans benefits the team’s research and will help guide future researchers and practitioners, according to Jeyavijayan Rajendran, an NYU-Poly electrical and computer engineering doctoral candidate and co-author. Rajendran was the 2009 winner of the Embedded Systems Challenge and has been the student leader of the national challenge since then. In the 2010 competition, Rajendran’s 2009-winning defense was successfully attacked. “I went back and studied the vulnerabilities and developed additional techniques to fix them,” he says. “The Embedded Systems Challenge changed my research process. Now I am not only thinking from a defender’s point of view, but I am also thinking from an attacker’s point of view.”

Trojans from the Embedded Systems Challenge and the design-for-trust techniques are available on TrustHub.org, a National Science Foundation (NSF) funded site created to encourage community building and knowledge exchange among hardware security researchers and professionals. NYU-Poly is one of four cybersecurity research institutions that founded the site.

Source:http://www.prnewswire.com/news-releases/student-hackers-and-a-dose-of-skepticism-secure-vital-hardware-133430973.html

Kids and Hackers, Oh My! DefCon Adds Kids Track

August 8th, 2011

Fewer things seem out of place at the rough-hewn DefCon hacker convention than a swarm of kids.

For 18 years, hackers —and the computer security experts who track them— have gathered at DefCon, one of the largest and longest-running conferences of its kind, to share information about breaching and securing computers and other devices.

This year’s DefCon featured what some hardcore attendees might consider to be a startling sight: children. For the first time, DefCon included discussions and tutorials for budding hackers, ages 8 to 16. Some 60 kids showed up.

Over two days, they met prominent hackers, Homeland Security officials and NSA security experts. They also listened to talks on the history of hacking, and lectures on cryptography. Some of the convention’s hotly contested competitions were geared toward children, as well. One contest covered lock-picking techniques to be used in the event they forget their locker combination. The kids were encouraged to find security vulnerabilities in popular technologies, from video games to computer hardware.

Children were required to have a parent with them. Many parents who brought their kids are longtime DefCon attendees who said they were excited about the bonding opportunity.

Rey Ayers, 42, an information security specialist for a utility company in the San Francisco Bay area, has attended DefCon for the past four years. He brought his son, Xavier, 14, who has been tinkering with computers for years and already has two information technology certifications.

Ayers said it was important to introduce his son to the hacker community, adding that they’ve talked extensively about the difference between ethical and unethical hacking.

“I see it in him — he feels like he belongs to a clan, to a group. I’m really proud,” Rey Ayers said in an interview. “I can see he has the excitement in his eyes.”

Xavier, his backpack decked out in new pins with hacker logos, said he’s trying to follow in his dad’s footsteps. The conference has given them new ideas to explore. The two look forward to finding vulnerabilities in wireless networks together when they get home to Vallejo, California. Xavier, who hacks mostly with his dad, said he hoped to meet some kids his age at the conference who might become his hacking pen pals.

“I feel like a community here — it’s like I’m not the only kid,” Xavier said.

The emergence of the DefCon kids’ conference comes as hackers are making headlines around the world. Though the general public often associates hacking with criminality, the engineering culture of the technology mainstream has always embraced people who explore the boundaries of what can be done with computers and other gadgets. Steve Jobs and Stephen Wozniak, the co-founders of Apple Inc., have said they considered themselves “hackers” when they created the first Apple computers in the mid-1970s.

Recent hacker attacks, however, play into stereotypical definitions of hackers. On Saturday, for instance, the hacker group Anonymous broke into 70 U.S. law enforcement websites, illustrating the growing threat from criminal hackers.

DefCon and its more-polished relative, the Black Hat technical security convention, drew thousands of people here in Las Vegas. They came for the revelry and intense discussion of new vulnerabilities in devices ranging from mobile phones to insulin pumps and critical infrastructure.

Black Hat, which is an industry sponsored event and costs up to $2,500 to enter, had more than 6,000 attendees. Vendors and executives in suits were there to schmooze and strike deals until Black Hat ended on Thursday.

DefCon, which ended Sunday, costs $150 to enter. Organizers stopped counting the number of attendees after they sold 10,000 badges on the first day. Most attendees wore t-shirts and shorts. One popular annual pastime at DefCon involves trying to identify undercover federal agents. DefCon ended Sunday.

This year many attendees rallied around a hacker named “Barkode” who has a blood disease and needs an urgent bone marrow transplant. Volunteers running a blood drive on site offered free mohawks to all donors. Conference organizers said the drive was so successful that extra supplies were needed to handle the donations.

Wolfe and Behr Crouse of Conroe, Texas proudly sported mohawks. Wolfe, 11 and Behr, 8 outlined the family hacking hierarchy.

“He’s the hacker, I’m the lockpicker. I get him in the building,” Behr said.

So how long has he been a lockpicker? Less than a day, his mother laughed. He got the bug after picking locks with some success at DefCon.

The boys’ parents, Rick and Kirsten, are both techies. They came to DefCon to introduce their boys to the culture. Rick has attended for the past three years. He said he wanted Wolfe and Behr to see the constructive applications of hacking.

“The technology itself isn’t good or evil — it’s what you do with it,” Rick Crouse said.

Kirsten Crouse added that they wanted to show examples of math and science in action to convey the importance of doing well in school.

“It’s an amazing opportunity for the kids to see what the options are out there.

Source:http://abcnews.go.com/Technology/wireStory?id=14251682&page=2

Hacker reveals battery meltdown attack on MacBooks

August 1st, 2011

We depend on our computers to get work done, and so we try to safeguard them appropriately. But our trusty laptops, desktops, and tablets rely on their own internal network of sophisticated computer chips to function. These tiny chips–called microcontrollers–regulate everything from the battery in your laptop to the headlights on your car–and they aren’t always so secure.

Microcontrollers have their own CPU and enough discrete memory to run simple programs, and although they’re usually designed for a single task, they can be reprogrammed via updates to the device firmware. Typically the hardware manufacturer delivers such downloadable updates to improve the performance of your device, but there’s nothing stopping a hacker from mimicking those updates and injecting your device with malicious code.

Thankfully, hackers such as Charlie Miller are happy to demonstrate the potential pitfalls of purchasing hardware from manufacturers that don’t secure seemingly “dumb” devices like batteries. Miller is a security researcher for Accuvant Labs, and after demonstrating how a hacker could take over your iPhone with a text message at the Black Hat security conference in 2009, he went looking for a more exciting hack.

Source:http://www.itbusiness.ca/it/client/en/home/News.asp?id=63521

Corporations Offer Cash Reward for Computer Hackers

August 1st, 2011

The current law recognizes computer hackers as criminals capable of being prosecuted for stealing information, ruining software and hardware or even for breaching firewalls – a form of cyber-trespassing.

Now, as with many other “traditional” criminals, wanted notices are popping up all over the Internet offering cash rewards for information leading to the capture of hackers responsible for some of the more publicized hacks in recent news.

Microsoft announced a $250,000 reward for the hacker responsible for creating the pseudo-company Rustock, the origin of a “botnet” capable of producing up to 1 billion spam emails a day, many of which indirectly disrupts and threatens Microsoft services. Analysts estimated that Rustock involved the use of more than 1 million infected computers and was responsible for nearly half of all spam sent worldwide in 2010.

Sony contemplated a similar move in May when it was discovered its PlayStation Network was hacked, resulting in the potential exposure of 100 million accounts to identity theft. Ultimately, the decision was left on the table without action, but observers take it as a sign of the severity of the situation.

This isn’t the first time bounties have been offered for the identification of individuals involved in cyber attacks, particularly for Microsoft. The company partnered with the Federal Bureau of Investigation, Interpol and the U.S. Secret Service in 2003 to offer a $5 million reward for the capture of hackers deploying computer viruses at the time.

Then, as now, critics who espouse a more nuanced understanding of the hacker culture argue that offering a reward is wasted effort. The consensus is that hackers have a sense of loyalty for their peers not found in other criminal fields, and that a bounty may only encourage the more talented in the hacker community to be bolder in their attacks so as to attract more recognition.

Only time will tell if offering a reward will become an effective new tool of cybersecurity, and whether law enforcement professionals at the state and federal level will begin embracing the practice.

Source:http://www.criminaljusticedegreeschools.com/corporations-offer-cash-reward-for-computer-hackers-0731111/

Hackers attack another Sony network, post data

June 3rd, 2011

Hackers broke into Sony Corp’s computer networks and accessed the information of more than 1 million customers to show the vulnerability of the electronic giant’s systems in the latest of several security breaches undermining confidence in the company.

LulzSec, a group that claims attacks on U.S. PBS television and Fox.com, said it broke into servers that run Sony Pictures Entertainment websites. It published the names, birth dates, addresses, emails, phone numbers and passwords of thousands of people who had entered contests promoted by Sony.

“From a single injection, we accessed EVERYTHING,” the hacking group said in a statement. “Why do you put such faith in a company that allows itself to become open to these simple attacks?”

The security breach is the latest attack against high-profile firms, including defense contractor Lockheed Martin and Google Inc .

LulzSec’s claims came as Sony executives were trying to reassure U.S. lawmakers at a hearing on data security in Washington about their efforts to safeguard the company’s computer networks, which suffered the biggest security breach in history in April.

Sony has been under fire since hackers accessed personal information on 77 million PlayStation Network and Qriocity accounts, 90 percent of which are users in North America or Europe.

Sony said at the time that credit card information may have been stolen, sparking lawsuits and casting a shadow over its plans to combine content and hardware products via online services. Nobody has claimed responsibility for the April attack.

Sony said it was investigating the breach claimed by LulzSec and declined to elaborate. Sony shares in Tokyo fell 0.3 percent on Friday, in line with the broader market.

Reuters confirmed the authenticity of the data on several contestants that LulzSec said it had published.

CYBER SECURITY

Cyber security is quickly rising up the agenda for global policymakers.

The Australian government said on Friday it will develop a cyber defence strategy and the United States said in a report in May that hostile acts in cyberspace would be treated just like any other threat to the country. [ID:nL3E7H300H][ID:nN3135624]

The hacking attack on Lockheed may have compromised the safety of SecureID tokens made by EMC Corp , while that on Google targeted, among others, senior U.S. government officials’ data. [ID:nN02261322][ID:nN02290419]

“These allegations are very serious,” U.S. Secretary of States Hillary Clinton said of the Google attack, which the Internet giant said appeared to originate in China.

In the latest attack on Sony, the U.S. Federal Trade Commission could choose to review the circumstances leading up to the breach if Sony Pictures Entertainment failed to use proper procedures for protecting the data of its customers.

John Bumgarner, chief technology officer for the U.S. Cyber Consequences Unit, a nonprofit group that monitors Web threats, said he was not surprised that Sony’s systems had again been breached.

“The system was unsecure,” said Bumgarner, who last month warned of a string of security vulnerabilities across Sony’s networks that he had identified.

He said he found vulnerabilities in the Sony Pictures Entertainment network as recently as last weekend.

The first hacking attacks in April prompted Sony to shut down its PlayStation Network and other services for close to a month.

Representatives criticized Sony in the Congressional hearing for waiting several days to notify customers of the breach.

LulzSec has claimed responsibility for several hacks over the past month. It said it defaced the U.S. PBS television network’s websites, and posted data stolen from its servers on Monday to protest a “Front Line” documentary about WikiLeaks.

It has also broken into a Fox.com website and published data about contestants for the upcoming Fox TV talent show, “X Factor.”

LulzSec also said on Thursday it had hacked into Sony BMG Music Entertainment Netherlands and Belgium. It previously disclosed an attack on Sony Music Japan. (Additional reporting by Diane Bartz in Washington, Mayumi Negishi in Tokyo; Editing by Steve Orlofsky, Richard Chang and Muralikumar Anantharaman)

Source:http://www.reuters.com/article/2011/06/03/sony-idUSN028845820110603

Get Adobe Flash playerPlugin by wpburn.com wordpress themes