Tag Archive for: Research

Facebook Password Stealing Apps Found on Android Play Store

/in

android malware

Even after many efforts made by Google last year, malicious apps always somehow manage to make their ways into Google app store.

Security researchers have now discovered a new piece of malware, dubbed GhostTeam, in at least 56 applications on Google Play Store that is designed to steal Facebook login credentials and aggressively display pop-up advertisements to users.

Discovered independently by two cybersecurity firms, Trend Micro and Avast, the malicious apps disguise as various utility (such as the flashlight, QR code scanner, and compass), performance-boosting (like file-transfer and cleaner), entertainment, lifestyle and video downloader apps.

Like most malware apps, these Android apps themselves don’t contain any malicious code, which is why they managed to end up on Google’s official Play Store.

Once installed, it first confirms if the device is not an emulator or a virtual environment and then accordingly downloads the malware payload, which prompts the victim to approve device administrator permissions to gain persistence on the device.

“The downloader app collects information about the device, such as unique device ID, location, language and display parameters,” Avast said. “The device’s location is obtained from the IP address that is used when contacting online services that offer geolocation information for IPs.”

How Android Malware Steals Your Facebook Account Password

As soon as users open their Facebook app, the malware immediately prompts them to re-verify their account by logging into Facebook. Instead of exploiting any system or application vulnerabilities, the malware uses a classic phishing scheme in order to get the job done.

These fake apps simply launch a WebView component with Facebook look-alike login page and ask users to log-in. Apparently, WebView code steals the victim’s Facebook username and password and sends them to a remote hacker-controlled server.

“This is most likely due to developers using embedded web browsers (WebView, WebChromeClient) in their apps, instead of opening the webpage in a browser,” Avast said.

Trend Micro researchers warn that these stolen Facebook credentials can later be repurposed to deliver “far more damaging malware” or “amass a zombie social media army” to spread fake news or generate cryptocurrency-mining malware.

Stolen Facebook accounts can also expose “a wealth of other financial and personally identifiable information,” which can then be sold in the underground markets.

Security firms believe that GhostTeam has been developed and uploaded to the Play Store by a Vietnamese developer due to considerable use of Vietnamese language in the code.

According to the researchers, the most users affected by the GhostTeam malware reportedly resides in India, Indonesia, Brazil, Vietnam, and the Philippines.

Besides stealing Facebook credentials, the GhostTeam malware also displays pop up adverts aggressively by always keeping the infected device awake by showing unwanted ads in the background.

All the apps have since been removed by Google from the Play Store after researchers reported them to the company. However, users who have already installed one such app on their devices should make sure they have Google Play Protect enabled.

Play Protect security feature uses machine learning and app usage analysis to remove (i.e. uninstall) malicious apps from users Android smartphones in an effort to prevent any further harm.

Although malicious apps floating on the official app store is a never-ending concern, the best way to protect yourself is always to be vigilant when downloading apps, and always verify app permissions and reviews before you download one.

Moreover, you are strongly advised to keep a good antivirus app on your mobile device that can detect and block such threat before they infect your device, and most importantly, always keep your device and apps up-to-date.

The Hacker News

Hackers use NSA’s leaked EternalBlue exploit to power more malicious payloads

/in ,

Hackers are expanding the use of EternalBlue, the leaked NSA hacking exploit that was thrust into the spotlight in May with its initial use in the WannaCry ransomware and Adylkuzz cryptocurrencyminer.

Security researchers have now found threat actors exploiting the vulnerability in Microsoft Server Message Block (SMB) protocol to distribute other malicious payloads including Backdoor.Nitol and Trojan Gh0st RAT.

Backdoor.Nitol is a Trojan horse that opens a backdoor on the infected computer. Gh0st RAT is a remote access trojan that has been making the rounds for years to target Windows machines and is capable of giving attackers full access and control of an infected machine. It has also been used in extensive cyber espionage and data stealing campaigns.

According to security firm FireEye, both the well-known payloads have been previously used in cyberattacks targeting the aerospace and defence industry with Gh0st RAT targeting government agencies and activists as well.

“We observed lab machines vulnerable to the SMB exploit were attacked by a threat actor using the EternalBlue exploit to gain shell access to the machine,” FireEye researchers said in blogpost. “The initial exploit technique used at the SMB level is similar to what we have been seen in WannaCry campaigns.

“However, once a machine is successfully infected, this particular attack opens a shell to write instructions into a VBScript file and then executes it to fetch the payload on another server.”

Researchers said the combination of EternalBlue and VBScript has been used to distribute Gh0st RAT in Singapore and Backdoor.Nitol in the South Asia region.

EternalBlue came as part of the cache of alleged NSA hacking tools released by notorious hacking group Shadow Brokers in April.

Security researchers warned that with EternalBlue exploit now released and available for any threat actors to target, it is likely that it will be used in new sophisticated and more frequent cyberattacks.

“The addition of the EternalBlue exploit to Metasploit has made it easy for threat actors to exploit these vulnerabilities,” FireEye said. “In the coming weeks and months, we expect to see more attackers leveraging these vulnerabilities and to spread such infections with different payloads.

“It is critical that Microsoft Windows users patch their machines and update to the latest software versions as soon as possible.”

IBTimes

15 Vulnerable Sites To (Legally) Practice Your Hacking Skills

/in ,

As technology grows, so does the risk of getting hacked. So, it should come as no surprise that InfoSec skills are becoming more important and more in demand. No matter if you’re a beginner or an expert, nor if you’re a security manager, developer, auditor, or pentester – you can now get started by using these 15 sites to practice your hacking skills – legally. They say the best defense is a good offense – and it’s no different in the InfoSec world. Here’s our updated list of 15 sites to practice your hacking skills so you can be the best defender you can – whether you’re a developer, security manager, auditor or pen-tester. And remember – practice makes perfect! Are there any other sites you’d like to add to this list? Let us know below!

1 bWAPP

bWAPP, which stands for Buggy Web Application, is “a free and open source deliberately insecure web application” created by Malik Messelem, @MME_IT. Vulnerabilities to keep an eye out for include over 100 common issues derived from the OWASP Top 10.bWAPP is built in PHP and uses MySQL. Download the project here. For more advanced users, bWAPP also offers what Malik calls a bee-box, a custom Linux VM that comes pre-installed with bWAPP.

2 Damn Vulnerable iOS App (DVIA)

Recently re-released as a free download by InfoSec Engineer @prateekg147, DVIA was built as an especially insecure mobile app for iOS 7 and above. For mobile app developers the platform is especially helpful, because while there are numerous sites to practice hacking web applications, mobile apps that can be legally hacked are much harder to come by!Get going with DVIA by watching this YouTube video and reading the ‘Getting Started‘ guide.

3 Game of Hacks

Alright, this one isn’t exactly a vulnerable web app – but it’s another engaging way of learning to spot application security vulnerabilities, so we thought we’d throw it in. Call it shameless self-promotion, but we’ve received amazing feedback from security pros and developers alike, so we’re happy to share it with you, too! The game is designed to test your AppSec skills and each question offers a chunk of code which may or may not have a security vulnerability – it’s up to you to figure it out before the clock runs out. A leaderboard makes Game of Hacks just that much more enticing.

4 Google Gruyere

This ‘cheesy’ vulnerable site is full of holes and aimed for those just starting to learn application security. The goal of the labs are threefold:

  • Learn how hackers find security vulnerabilities
  • Learn how hackers exploit web applications
  • Learn how hackers find security vulnerabilities
  • Learn how to stop hackers from finding and exploiting vulnerabilities

“‘Unfortunately,’ Gruyere has multiple security bugs ranging from cross-site scripting and cross-site request forgery, to information disclosure, denial of service, and remote code execution,” the website states. “The goal of this code lab is to guide you through discovering some of these bugs and learning ways to fix them both in Gruyere and in general.”

Written in Python, Gruyere offers opportunities for both black box and white box testing so “hackers” have the chance to play on both sides of the fence.

Get started here: http://google-gruyere.appspot.com/

5 HackThis!!

HackThis!! was designed to teach how hacks, dumps, and defacement are done, and how you can secure your website against hackers. HackThis!! offers over 50 levels with various difficulty levels, in addition to a lively and active online community making this a great source of hacking and security news and articles.
Get started with HackThis!! here.

6 Hack This Site

HackThisSite! is a legal and safe place for anyone to test their hacking skills. The hub offers hacking news, articles, forums, and tutorials and aims to teach users to learn and practice hacking through skills developed by completing challenges.Start your training on HackThisSite here

7 Hellbound Hackers

Hellbound Hackers, the hands-on approach to computer security, offers a wide array of challenges with the aim to teach how to identify exploits and suggest the code to patch it. And Hellbound Hackers really is the ultimate site for hacking tutorials, covering a large range of topics from encryption and application cracking, to social engineering and rooting. With a community of nearly 100k registered members, it’s also one of the biggest hacking communities out there.
Read more and get started here.

8 McAfee HacMe Sites

Foundstone, a practice within McAfee’s Professional Services, launched a series of sites in 2006 aimed for pen testers and security professionals looking to increase their InfoSec chops. Each simulated app offers a “real-world” experience, built with “real-world” vulnerabilities. From mobile bank apps to apps designed to take reservations, these projects cover a wide array of security issues to help any security-minded professional stay ahead of the hackers.
The group of sites include:

9 Mutillidae

Yet another OWASP project on our list, Mutillidae is another deliberately vulnerable web application built for Linux and Windows. This project is actually a set of PHP scripts containing all the OWASP Top Ten vulnerabilities and more and is armed with hints to help users get started.
Get started with Mutillidae here, and be sure to check out the projects dedicated YouTube channel and Twitter account, run by Mutillidae’s second-generation developer, Jeremy Druin.

10 OverTheWire

OverTheWire is great for developers and security professionals of all experience levels to learn and practice security concepts. This pracrice comes in form of fun-filled wargames – beginners should start with “Bandit”,. where the basics are taught, and will progress to higher levels and to advanced games all with more complex bugs and exploits to patch as you go. Jump in the game here

11 Peruggia

Peruggia is a safe environment for security professionals and developers to learn and test common attacks on web applications. Peruggia is set as an image gallery in which you can download projects to help you learn how to locate and limit potential issues and threats. Download Peruggia here.

12 Root Me

Root Me is a great way to challenge and improve your hacking skills and web security knowledge through over 200 hacking challenges and 50 virtual environments. Check out Root Me here.

13 Try2Hack

Created by ra.phid.ae and considered one of the oldest challenge sites still around, Try2Hack offers multiple security challenges.
The game features diverse levels which are sorted by difficulty, all created to practice hacking for your entertainment. There is an IRC channel for beginners where you can join the community and ask for help, in addition to a full walkthrough based on GitHub.Try2Hack is available here.

14 Vicnum

An OWASP project, Vicnum is a series of basic and obviously web apps based on games “commonly used to kill time.” Because of their simple frameworks, the applications can be tailored for different needs, making Vicnum a great choice for security managers looking to help teach developers AppSec in a fun way.

The goal of Vicnum is “to strengthen the security of web applications by educating different groups (students, management, users, developers, auditors) as to what might go wrong in a web app, the site says. “And of course it’s OK to have a little fun.”

Check out the site, developed by Mordecai Kraushar here to find the games and available CTFs for download.

15 WebGoat

One of the most popular OWASP projects is WebGoat. This insecure app provides a realistic teaching and learning environment with lessons designed to teach users about complex application security issues. WebGoat is aimed for developers looking to learn more about web app security. The name WebGoat is a scapegoat reference: “Even the best programmers make security errors. What they need is a scapegoat, right? Just blame it on the ‘Goat!’”
Installs are available for Windows, OSX Tiger and Linux and has separate downloads for J2EE and .NET environments. There is an “easy-run” version as well as a “source distribution” version that allows users to modify the source code.

Check out the OWASP project page here or the GitHub page to get started with WebGoat.

For help with the lessons, take a look at this series of videos available for download.

Critical flaw in Twitter’s code could let hackers take over your account

/in ,

A security researcher discovered a critical vulnerability in the advertising code of Twitter, the most popular micro-blogging website in the world, which if exploited could let hackers publish updates from any other account without needing access to the victim’s profile.

The white-hat hacker, writing in a blog post this week (22 May), claimed to have uncovered the issue while exploring Twitter’s code for bugs. He said the flaw could give cybercriminals the ability to “publish entries in Twitter-network by any user of this service.”

The vulnerability was initially found on 26 February 2017 and fixed two days later.

The hacker, known as kedrisch, reported the flaw via Twitter’s bug bounty service – a programme managed by the organisation HackerOne which lets researchers disclose bugs in exchange for rewards.

In this instance, kedrisch was handed a bounty of $7,560 (₦2,872,800) for his efforts.

The issue he found was in Twitter’s advertising code. Essentially, the researcher said flaws existed in how the service’s media library uploaded files such as videos, images and gifs to the platform.

Rules surrounding the responsible disclosure programme mean the flaw is only coming to light now.

In a statement, Twitter said: “The reporter discovered a flaw in the handling of Twitter Ads Studio requests which allowed an attacker to tweet as any user.

“By sharing media with a victim user and then modifying the post request with the victim’s account ID the media in question would be posted from the victim’s account. This bug was patched […] and no evidence was found of the flaw being exploited by anyone other than the reporter.”

Charlie Miller, a security expert well-known for being part of the collective which remotely hacked a 2014 Jeep Cherokee, tweeted: “As former appsec [Application Security] tech lead for Twitter, I’ll just say I’m not shocked this was in code from the ads team.” He did not elaborate further.

 Last December, kedrisch was awarded $1,120 (₦425,600) for finding a less critical flaw which could let a hacker change comments on Twitter’s official forums. This was publicly disclosed on 12 May 2017.
Most recently, Twitter issued a warning to users of its Vine service that a bug potentially exposed users’ email addresses and phone numbers to unnamed third parties. In an email sent to all impacted Vine users, it said the bug affected the Vine Archive for “less than 24 hours”.
Vine was bought by Twitter back in 2012 however the company decided to shut down the popular short video publishing application earlier this year amid a period of heavy job cuts.

“We want to emphasise that this information can’t directly be used to access your account, and we have no information indicating that it has been misused,” Twitter’s email to Vine users stressed. “We take these incidents very seriously, and we’re sorry this occurred,” it added.

IBTimes

Why Companies Shouldn’t Try to Hack Their Hackers

/in

During a recent cybersecurity competition, teams of students conducting a mock exercise unintentionally caused the U.S. to start a (fake) war. The students were given a variety of options, including diplomatic ones, for responding to a cyberattack by China. The majority of them took an aggressive approach, known as “hack back,” with disastrous consequences. The mock exercise shows how tempting it is to launch a counterstrike in response to a cyberattack — and the potential for significant unintended consequences.

As the CEO of a publicly traded security company, I would like to urge businesses and individuals to beware those very same dangers. In the United States, the Computer Fraud and Abuse Act (CFAA) prohibits private parties from accessing or damaging computer systems, even if they’re being used to attack you or your business.

But legislation in Congress would change that, giving private-sector businesses and individuals the right to strike back and hack their hackers. The idea behind the proposal is to empower people “to defend themselves online, just as they have the legal authority to do during a physical assault.” I believe the measure would do more harm than good. Here’s why.

Holes in the Self-defense Defense

It may sound reasonable that the same principle that allows homeowners to defend themselves against intruders, even if it involves causing harm to the attackers, should hold true for cyberattacks. But the reality is, unfortunately, that it would be akin to lobbing grenades from your front yard, hoping to get lucky and hit an attacker you haven’t seen as they flee the scene of the crime. Even if you do manage to hurt your attacker, you’ll likely hurt other people, too. In hack back, it’s almost impossible to ensure that an action targeted at a specific actor or group of actors will affect only the intended targets. After all, the internet is designed specifically for the purpose of systems interacting and communicating. Technology and users are increasingly interconnected.

It’s Difficult to Identify Your Attacker

Another significant challenge is that cyberattacks, which are sometimes discovered years after a security breach, are difficult to attribute to the correct actor. Hackers are constantly evolving their techniques to stay one step ahead of defenders and law enforcement. Sometimes they use deception techniques to plant indicators that point to some other perpetrator, either to throw off suspicion or to incriminate another party.

This is even more problematic when you consider that devices operating as unwilling parts of a botnet may be used to carry out an attack. These infected devices — and their owners — are as much victims of the attacker as the primary target, yet any attempt to hack back could cause them harm. Even governments, which possess the large-scale, sophisticated intelligence-gathering programs needed to accurately attribute cyberattacks, can take a long time to do so. Private-sector organizations typically do not have these resources.

Running Afoul of the Law of Proportionality

In the wake of a cyberattack, even if the attacker has been identified, it is difficult to judge motivation accurately and to determine an appropriate response. Remember the students competing in the mock cybersecurity exercise, the ones who ended up at war? They thought their response was proportional, but the situation quickly got out of hand.

Sometimes the need for information is used as an argument for hacking back. The argument is that it can help with intelligence gathering. However, intelligence gathering is not the same as mounting a digital counterstrike. There are a number of intelligence-gathering measures that U.S. organizations can take that do not run afoul of the CFAA. For example, organizations can deploy honeypots in their own networks to capture information on the attacker and their methods.

Essentially, hack back legislation would put the ability to launch cyberattacks, decide proportional responses, and infiltrate systems into the hands of companies and individuals. If hack back is legalized and private-sector companies have it in their arsenals, I fear it could become the de facto response — rather than considering the broad range of options that do not involve hacking back.

New Pressure on Company Resources

Clearly, hacking back effectively would require specialized skills and costly investments. Were it legalized with an authorization framework that is insufficiently stringent, I fear that many organizations may try to participate without the necessary tools and expertise to carry it out. That is likely to be ineffective, damaging, or both.

Other companies cannot afford a great deal of in-house security expertise and technologies to protect themselves today. Hack back capability is a nonstarter for them. That will make them even more vulnerable if hack back is legalized. Profit-motivated attackers may try to avoid companies that threaten to strike back. Instead, they’ll target the unfortunate organizations below this security poverty line.

Legal Landmines in a Lawless “Land”

While the internet is a borderless space accessed from every country in the world, each of those countries has its own legal system and expects its citizens to abide by it. It would be very risky for companies and individuals who hack back to avoid running afoul of the laws of another country and international law.

When national governments do this, it tends to occur within existing international legal frameworks and under some regulatory oversight. It must meet a stringent burden of proof for attribution. There are parameters determining the types of targets that can be pursued and which actions can be taken. Any hack back authorization would need considerable government oversight to avoid abuse by the private sector and minimize collateral damage.

For example, what if a company hacks back and accidentally hurts another company or individual? The company could incur expensive legal proceedings, reputational damage, and loss of trust. Making organizations exempt from this kind of legal action around unintended consequences is problematic. How could we spot and stop accidental or intentional abuses of the system? Giving the private sector hack back capability would require a complex legal framework and oversight system. Who would run it? How would it be funded? This seems impractical and costly.

It’s hard to blame companies for feeling helpless in the wake of cyberattacks that have shut factories, paralyzed hospitals, and publicized proprietary corporate data. From phishing scams to ransomware to vulnerabilities in medical devices, connected electronics, and even the entire power grid, no one likes to feel that they are constantly on the losing end of a shadowy war against clandestine cyberattackers, with no hope in sight. That feeling of helplessness is behind a growing call for companies to be able to hack back.

Yet the potential costs of a misstep and the unintended consequences should deter business leaders from undertaking such an effort. We must instead work together to find solutions to our complex cybersecurity problems that are better than legitimizing vigilantism, particularly given its significant risks and dubious benefits. It’s one thing for students to unintentionally trigger a disaster in the safe confines of a competitive mock scenario. It’s another thing entirely to be a business leader that does so in the real world.

Harvard Business Review

Facebook is developing a way to read your mind

/in ,

“What if you could type directly from your brain?”

That was the question Facebook executive Regina Dugan, who runs the company’s secretive research and hardware lab Building 8, posed to the audience Wednesday at the company’s annual F8 developer conference in San Jose.

The question was not meant to be rhetorical. Dugan and Facebook are actually making technology intended to do just that.

Facebook is building what it calls a “brain-computer speech-to-text interface,” technology that’s supposed to translate your thoughts directly from your brain to a computer screen without any need for speech or fingertips.

The idea is that this technology will be able to take what you’re thinking to yourself in silence, using non-invasive sensors that can read exactly what you intend to say, and turn it into readable text.

Dugan says the idea is not that crazy. She showed video of a woman from a Stanford research experiment who could type eight words per minute using a small electrode implanted into her brain to move a computer cursor over a keyboard.

Dugan says Facebook’s goal is to create technology that could autonomously type 100 words per minute based on a person’s thoughts “in a few years.”

The goal is to “one day become a speech prosthetic for people with communication disorders or a new means for input to AR,” she wrote on her Facebook page. “Even something as simple as a ‘yes/no’ brain click or a ‘brain mouse’ would be transformative.”

It is supposed to only detect activity in a very specific region of the brain where thoughts are translated into speech. “We are not talking about decoding your random thoughts,” she said. “That might be more than any of us care to know.”

But in order to ensure that Facebook is only translating the thoughts you want to share, the company says it will need to build new sensor technology that can better detect brain activity at lightning speed.

That tech doesn’t yet exist, but the company says it has over 60 scientists working on it now. Facebook also expects to create and ship these sensors at scale, thanks in part to miniaturization advancements from the telecom industry.

Reading the human brain isn’t the kind of technology announcement we’re used to seeing from Facebook, which makes truckloads of money advertising against user selfies and home videos.

But Facebook signaled that it had widespread ambitions last year when Dugan was hired and her new secret research lab, Building 8, was announced alongside hundreds of millions in funding. And Facebook spent the better part of its F8 presentations talking about its plans for augmented reality; the company envisions a world where smartphones will be replaced by smart glasses and keyboards may not exist.

Dugan previously ran the U.S. military’s research lab, DARPA, and then worked at Google before joining Facebook, and her work thus far has been kept private. It turns out that her plans for Facebook are as audacious as you might have imagined when she joined.

“Is it a little terrifying? Of course,” she said at the end of her keynote address. “If we fail, it’s gonna suck.”
CEO Mark Zuckerberg has not been shy about his scientific ambitions — but most of those have been linked to his philanthropic efforts, specifically a pledge with his wife Priscilla to spend $3 billion over the next decade trying to cure all disease.

In a lengthy letter published in February, Zuck made just a small mention of “accelerating science” amid lots of talk about creating global communities.
It’s the interface

Facebook isn’t only planning to listen to your thoughts. The company is also building technology to communicate with humans through their skin.

Facebook says its technology will act like the cochlea part of the ear, which translates sound into frequencies that are sent to the brain and decoded. Only rather than using your ears, Facebook says it will use your skin.

Though details on this project are slim, the social media company compared its new project with braille, which translates specific surface textures into words and is used by those who are visually impaired.

Recode

A Wrist Sensor That Works up a Sweat

/in ,

Researchers who are trying to find a way to make wearable health technology real say they’ve taken a big step with a device that generates enough sweat to be useful.

They’ve built a prototype that generates a few drops of perspiration — enough to measure blood sugar and to monitor other bodily functions.

It’s not ready for the market yet, but shows it is possible for people to wear lightweight devices that can deliver on the promise of pain-free diagnosis.

“You don’t stick people with anything. You can just wrap it on people’s hands and have them engage in their daily activities and you can continuously monitor them,” said Sam Emaminejad, who helped work on the device while at Stanford University.

Many groups are working to develop wearable health tech, from the glucose-sensing contact lens that Google currently has put on hold, to a so-called artificial pancreas that is really a series of linked devices that monitor blood sugar and deliver insulin as needed for diabetes patients.

What a wearable health device needs is enough bodily fluids to measure something, such as blood sugar, sodium or hormones. The time-honored method is a needle, and anywhere from a drop to a few vials of blood.

Non-invasive alternatives would have to use sweat.

There are several problems with that, number one being whether you can measure blood sugar or look for, say hormones, in sweat. Second is getting enough sweat to measure in the first place.

The Stanford team thinks they have done that.

They’ve put together sweat-stimulating compounds into a small device that delivers a low current. It can measure glucose, sodium and other compounds in the sweat and wirelessly relay that information.

“This platform extracts sweat (at a high secretion rate) on demand or periodically and performs sweat analysis in situ (in place),” they wrote in their report, published in the Proceedings of the National Academy of Sciences.

It was not painful and could be worn strapped to the arm. “It could be like a watch,” Emaminejad, who’s now at UCLA, told NBC News.

For proof of principle, the team measured blood sugar and minerals associated with flareups of cystic fibrosis in their volunteers. Such a device might be useful for monitoring a patient’s response to drugs, they said.

“One way I think this technology can be incorporated into our daily lives is to be incorporated into a smartwatch,” Emaminejad said. The compounds that stimulate sweating and that measure the desired compounds would need regular refreshing.

“We need a clever solution. Do we need a disposable cartridge that we can insert easily?” he asked.

And researchers will have to work on better ways to correlate measurements of blood sugar, lactase, potassium and other compounds taken from sweat to what doctors know they mean when measured in blood.

That’s one of the hiccups that held up work on the blood sugar-sensing contact lens — a lack of data on whether measurements in tears were as accurate as measurements taken from blood.

NBC News

Hackers can steal your password by looking at how you tilt your phone

/in

According to a team of cybersecurity experts at Newcastle University, the way you tilt your phone could be used by hackers to break into your device.

When it comes to security and the protection of privacy, people often worry about connecting to public Wi-Fi networks, tricking face recognition technology, or bypassing fingerprint sensors. What usually gets left out of the discussion is the multitude of basic motion and orientation sensors that can be found inside most smartphones and tablets today. Well, according to cyber-experts at Newcastle University, we should be paying more attention to these sensors that we take for granted every day.

According to the paper published by the team, they were able to crack four-digit pins with 70 percent accuracy on the first guess and 100 percent accuracy by the fifth guess.

Read more

Scientists invent new material for storing data

/in

Associate Professor Yang Hyunsoo (left) and research fellow Shawn Pollard are part of the team at the National University of Singapore working on the use of skyrmions as data carriers.

A nano-sized piece of film could hold the key to storage that is faster, holds more data and uses less power compared with current solid-state memory.

Scientists at the National University of Singapore’s Department of Electrical and Computer Engineering have combined cobalt and palladium into a film that’s capable of housing stable skyrmions, which are swirling magnetic textures a few nanometers in size that can store and process data, the university said Monday in a statement.

Read more

Researchers found it is scarily easy to crack Android users’ lock screen patterns

/in

If you use a lock screen pattern to protect your Android phone, it’s a lot less secure than you might think.

That’s the message from researchers at the University of Lancaster, who have put out a paper explaining how they were able to reconstruct people’s lock screen patterns with a high degree of accuracy by using discretely captured footage. (You can check out the full study below.) Read more