Interconnected smart toys “can be weaponised”

/in , ,

An audience of security experts attending a cybersecurity conference at the World Forum in The Hague (The Netherlands) on Tuesday were shocked when a demonstration done by an 11-year-old “cyber ninja” showed the dismal cyber security standards that are prevailing in technology. He hacked into the Bluetooth devices to manipulate a teddy bear and show how interconnected smart toys “can be weaponised”.

The wonder kid in question is American Reuben Paul, a cyber security expert and white hat hacker who’s currently studying in the sixth standard of a school in Austin, Texas. Techworm had reported about the hacking skills of Reuben way back in 2015 when he warned an audience about the dangers of smartphone hacking while delivering a keynote address as a 9-year-old.

“From airplanes to automobiles, from smartphones to smart homes, anything or any toy can be part of the” Internet of Things (IOT),” Reuben told the crowd. “From terminators to teddy bears, anything or any toy can be weaponised.”

As part of his live demonstration and to prove his point, Reuben deployed his cuddly looking teddy bear ‘Bob’, which connects to the iCloud via Wi-Fi and Bluetooth smart technology to receive and transmit messages.

He then plugged a “Raspberry Pi” – a tiny and low cost computer – into his laptop on stage and started scanning the hall for available Bluetooth devices. To the astonishment of everyone in the hall, Reuben was able to download dozens of numbers including some of top officials.

Then, using the programming language called Python, he went on to hack into his Internet-connected teddy bear via one of the numbers and turned on Bob’s lights and transferred a recorded message from the audience through to the bear.

“Most internet-connected things have a blue-tooth functionality … I basically showed how I could connect to it, and send commands to it, by recording audio and playing the light,” he told AFP explaining his demonstration.

“IOT home appliances, things that can be used in our everyday lives, our cars, lights refrigerators, everything like this that is connected can be used and weaponised to spy on us or harm us.”

For instance, they could be used to steal private information such as passwords, as remote surveillance devices to spy on kids, or to locate a person using GPS.

More terrifyingly, toys could even be programmed to say “meet me at this location and I will pick you up,” Reuben said.

Besides being a cyber-ninja, Reuben is also the youngest American to earn a black belt in Shaolin Kung Fu. With the help from his family, Reuben has set up a non-profit organisation called CyberShaolin whose purpose is to spread awareness about “the dangers of cyber-insecurity”.

Since his talk, Reuben has been receiving congratulatory messages on Twitter from various experts in the infosec community applauding his work.

Reuben’s father, Mano Paul, an IT expert, said that his kid’s cyber skills emerged at the age of six, when he began exploring how software systems worked.

“He has always surprised us. Every moment when we teach him something he’s usually the one who ends up teaching us,” he told the AFP.

Reuben hopes to study cyber-security at either CalTech or MIT universities.

TechWorm

IBM Warns Customers After Shipping Them Infected USB Drives

/in , ,

IBM is urging customers to destroy flash drives it shipped to storage system customers because they contain malware.

The company warned in an advisory Tuesday that an unspecified number of USB flash drives shipped with the initialization tool for Storwize systems contain malicious code. IBM instructed customers who received the V3500, V3700 and V5000 Gen 1 systems to destroy the drive to prevent the code from replicating.

“When the initialization tool is launched from the USB flash drive, the tool copies itself to a temporary folder on the hard drive of the desktop or laptop during normal operation,” IBM said in its advisory.

The malicious code is part of the Reconyc Trojan malware family, which typically targets computers in Russia and India, according to data from Kaspersky Lab.

IBM said that while the malware is copied onto the victim’s device, the malicious code is not executed during initialization.

IBM recommends users who have already inserted the drive into their systems run an antivirus system to remove the malware. Users can also remove the directory containing the identified malicious file.

It wasn’t immediately clear how the malware landed on the flash drives. IBM didn’t immediately respond to a request for comment.

The affected Initialization USB flash drive looks like the image below, and contains a folder called InitTool.

IBM infected USB

 

MasterCard adds fingerprint sensors to payment cards

/in , ,

Our fingerprints are quickly replacing PINs and passwords as our primary means of unlocking our phones, doors and safes. They’re convenient, unique, and ultimately more secure than easily guessed or forged passwords and signatures. So it makes sense that fingerprint sensors are coming to protect our credit and debit cards. MasterCard is testing out new fingerprint sensor-enabled payment cards that, combined with the onboard chips, offer a new, convenient way to authorize your in-person transactions. Instead of signing a paper receipt or entering your PIN while struggling to cover up the number pad, you simply place your thumb on your card to prove your identity.

Read more

A Wrist Sensor That Works up a Sweat

/in ,

Researchers who are trying to find a way to make wearable health technology real say they’ve taken a big step with a device that generates enough sweat to be useful.

They’ve built a prototype that generates a few drops of perspiration — enough to measure blood sugar and to monitor other bodily functions.

It’s not ready for the market yet, but shows it is possible for people to wear lightweight devices that can deliver on the promise of pain-free diagnosis.

“You don’t stick people with anything. You can just wrap it on people’s hands and have them engage in their daily activities and you can continuously monitor them,” said Sam Emaminejad, who helped work on the device while at Stanford University.

Many groups are working to develop wearable health tech, from the glucose-sensing contact lens that Google currently has put on hold, to a so-called artificial pancreas that is really a series of linked devices that monitor blood sugar and deliver insulin as needed for diabetes patients.

What a wearable health device needs is enough bodily fluids to measure something, such as blood sugar, sodium or hormones. The time-honored method is a needle, and anywhere from a drop to a few vials of blood.

Non-invasive alternatives would have to use sweat.

There are several problems with that, number one being whether you can measure blood sugar or look for, say hormones, in sweat. Second is getting enough sweat to measure in the first place.

The Stanford team thinks they have done that.

They’ve put together sweat-stimulating compounds into a small device that delivers a low current. It can measure glucose, sodium and other compounds in the sweat and wirelessly relay that information.

“This platform extracts sweat (at a high secretion rate) on demand or periodically and performs sweat analysis in situ (in place),” they wrote in their report, published in the Proceedings of the National Academy of Sciences.

It was not painful and could be worn strapped to the arm. “It could be like a watch,” Emaminejad, who’s now at UCLA, told NBC News.

For proof of principle, the team measured blood sugar and minerals associated with flareups of cystic fibrosis in their volunteers. Such a device might be useful for monitoring a patient’s response to drugs, they said.

“One way I think this technology can be incorporated into our daily lives is to be incorporated into a smartwatch,” Emaminejad said. The compounds that stimulate sweating and that measure the desired compounds would need regular refreshing.

“We need a clever solution. Do we need a disposable cartridge that we can insert easily?” he asked.

And researchers will have to work on better ways to correlate measurements of blood sugar, lactase, potassium and other compounds taken from sweat to what doctors know they mean when measured in blood.

That’s one of the hiccups that held up work on the blood sugar-sensing contact lens — a lack of data on whether measurements in tears were as accurate as measurements taken from blood.

NBC News

Why You Should Wait Before Buying Samsung’s New Galaxy S8

/in ,

When a splashy new smartphone hits the market, consumers often weigh whether to place an order right away or to wait and see how others react to the device.

But with the Galaxy S8, Samsung’s first major smartphone release since the spontaneously combusting Galaxy Note 7 was discontinued last year, there isn’t much of a debate. Your best bet is to wait to buy the roughly $750 device — not just for safety reasons, but also because other uncertainties surround it.

Samsung declined to provide an early review unit of the Galaxy S8 to The New York Times, but several consumer electronics experts who tried the device ahead of its release this Friday were cautiously optimistic about the product. Even so, they said the phone had some radical design changes that might make people uncomfortable, a few key features were unfinished and Samsung’s recent safety record remained a concern.

Read more

New tech harvests drinking water from (relatively) dry air using only sunlight

/in

A new device the size of a coffee mug can generate drinkable water from desert air using nothing but sunlight.

“With this device, you can harvest the equivalent of a Coke can’s worth of water in an hour,” says cocreator Omar Yaghi, a chemist at the University of California, Berkeley. “That’s about how much water a person needs to survive in the desert.”

Read more

More university students are using tech to cheat in exams

/in ,

A growing number of UK university students are cheating in exams with the help of technological devices such as mobile phones, smart watches and hidden earpieces.

Data obtained by the Guardian through freedom of information requests found a 42% rise in cheating cases involving technology over the last four years – from 148 in 2012 to 210 in 2016. Last year, a quarter of all students caught cheating used electronic devices.

Among the worst offenders were students at Queen Mary University of London, where there were 54 instances of cheating – two-thirds of which involved technology. At the University of Surrey, 19 students were caught in 2016, 12 of them with devices. Newcastle University, one the bigger institutions to provide data, reported 91 cases of cheating – 43% of which involved technology.

Read more

Scientists invent new material for storing data

/in

Associate Professor Yang Hyunsoo (left) and research fellow Shawn Pollard are part of the team at the National University of Singapore working on the use of skyrmions as data carriers.

A nano-sized piece of film could hold the key to storage that is faster, holds more data and uses less power compared with current solid-state memory.

Scientists at the National University of Singapore’s Department of Electrical and Computer Engineering have combined cobalt and palladium into a film that’s capable of housing stable skyrmions, which are swirling magnetic textures a few nanometers in size that can store and process data, the university said Monday in a statement.

Read more