IT security for the daily life: Withdrawing money at cash machines with 'Google Glass'

Taking photos with a wink, checking one's calendar with a glance of the right eye, reading text messages -- the multinational cooperation Google wants to make it possible with Google Glass. But what IT experts celebrate as a new milestone makes privacy groups skeptical. So far, few people have access to the prototype to test how it can be used in daily life. "Thanks to the Max Planck Institute for Informatics we are one of the few universities in Germany that can do research with Google Glass," says Dominique Schr?der, assistant professor of Cryptographic Algorithms at Saarland University.

The futuristic-looking device consists of a glasses frame on which a camera and a mini computer are installed. It depicts information in the user's field of vision via a glass prism that is installed at the front end of the right temple. According to the German computer magazine "c't," this causes an effect "as if the user were looking at a 24 inch screen from a distance of two and a half meters." Schr?der, who also does research at the Center for IT-Security, Privacy and Accountability (CISPA), located only a few yards away, is aware of the data security concerns with Google Glass: "We know that you can use it to abuse data. But it can also be used to protect data." T

o prove this, Schr?der and his group combine "Google Glass" with cryptographic methods and techniques from automated image analysis to create the software system "Ubic." By using Ubic, withdrawing money at a cash machine would change as follows: The customer identifies himself to the cash machine. This requests from a reliable instance the public key of the customer. It uses the key to encrypt the one-way personal identification number (PIN) and seals it additionally with a "digital signature," the digital counterpart of the conventional signature. The result shows up on the screen as a black-and-white pattern, a so-called QR code.

The PIN that is hidden below is only visible for the identified wearer of the glasses. Google Glass decrypts it and shows it in the wearer's field of vision." Although the process occurs in public, nobody is able to spy on the PIN," explains Schr?der. This is not the case if PINs are sent to a smart phone. To spy on the PIN while it is being entered would also be useless, since the PIN is re-generated each time the customer uses the cash machine. An attacker also wearing a Google Glass is not able to spy on the process, either. The digital signature guarantees that no assailant is able to intrude between the customer and the cash machine as during the so-called "skimming," where the assailant can impersonate the customer.

Only the customer is able to decrypt the encryption by the public key with his secret key. As long as this is safely stored on the Google Glass, his money is also safe. At the computer expo Cebit, the researchers will also present how Google Glass can be used to hide information. Several persons all wearing Google Glass can read the same document with encrypted text at the same time, but in their fields of vision they can only see the text passages that are intended for them.

"This could be interesting, for example, for large companies or agencies that are collecting information in one document, but do not want to show all parts to everybody," explains Mark Simkin, who was one of the developers of Ubic. A large electric company has already sent a request to the computer scientists in Saarbr?cken. Google Glass is expected to enter the American market this year.

View the original article here

Automatic daily security updates coming for OS X Mountain Lion

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

The new version of Mac OS X, Mountain Lion, is just around the corner and contains a feature which should go down well with security-minded end users.

AppleInsider reports that one of the new features included in OS X 10.8 Mountain Lion is automatic security updates.

That means that you will be able to configure any Macs you have that are running Mountain Lion to automatically check Apple's update servers on a daily basis (or when the computer is restarted) to see if a security update is available, and apply it without user interaction.

Of course, most days it is unlikely that Apple will have released a security update - but for those times when they have, this feature will hopefully reduce the window of opportunity for malicious hackers to exploit any vulnerabilities in OS X.

At its recent WWDC event, Apple revealed that its newest range of laptops are coming with a "PowerNap" feature, allowing security updates to be downloaded while the rest of the computer is in sleep mode.

This, alongside the removal of requiring the user to give permission for a security patch to be installed, should ensure that more Macs are kept more up-to-date.

Anything which makes that attack window smaller has to be good news for Mac users. So, well done Apple.

One thing that is interesting is that Apple claims to also be introducing a more secure connection to its update servers with Mountain Lion. Earlier this month it was revealed that the Flame malware had used a "man-in-the-middle" attack against the Windows update system.

Of course, in business environments the concept of automatic, silent updates to the Mac operating system may be less popular. Often organisations prefer to test a security update before rolling it out across a large number of computers, in case there are bugs or conflicts.

Furthermore, companies may not like the idea of lots of their Mac computers individually pulling down hefty security updates and gobbling up their internet bandwidth.

Presumably Apple will provide mechanisms for businesses to handle these issues when OS X ships next month.

Follow @gcluley

Image credit: AppleInsider

View the original article here

Android under assault as hacker attacks on phones go up 472 per cent in four ... - Daily Mail

By Daniel Bates

'Rogue' apps in market conceal malicious softwareDownloading can allow hackers to spy on your emailsApps 'steal' by sending texts to premium numbersAndroids at risk because apps aren't vetted before they join Android Market - unlike iPhone apps

Last updated at 3:17 PM on 18th November 2011

The success of phones running Google's Android software has meant cyber-attacks have risen 472 per cent in just three months - from cyber-spying apps to apps that add to your phone bill

Google's Android operating system is far, far ahead of Apple's iPhone - analysts Gartner said that phones running the operating system accounted for 52.5 per cent of the smartphone market this year, compared to 15.6 per cent for iOS devices.

But in computing, success always comes at a price.

Hackers target the most successful operating systems with their most virulent and hi-tech attacks, simply because there are more victims.

Malware infection rates amongst Android users are going up at their highest rate ever, putting huge pressure on Google to improve its security.

Since July the number of attacks has increased by 472 per cent with most of those coming in the past few weeks

The rise comes off the back of a report in May which said that over the previous year malware incidents had gone up 400 per cent.

The studies were carried out by IT security firm Juniper Networks which blamed Google’s poor security for allowing so many users to be affected.

It said that once installed malicious programmes could either send personal information to a third party, or send text messages to a premium rate number without the person’s knowledge, costing them money that is not recoverable.

Google is particularly vulnerable because it doesn't 'vet' apps in its marketplace, unlike Apple - making it open season for hackers.

HTC's Evo 4G handset runs Google's popular Android software: But the internet giant's anything-goes approach to its app store has led to an increase in cyber attacks on users

Google’s Android is now the most popular platform for downloading apps, beating the iPhone and the iPad combined.

The operating system accounted for 44 per cent of all app downloads in the second quarter of this year. Apple only got 31 per cent across all of its platforms.

Android has become a target for hackers and others with malicious intent partly because it is the market leader.

But according to Juniper Networks, Google must also take some of the blame because there is no review process before an app is placed in the App Store.

Adding to the problem is that Android is open source, meaning it is far easier to create and App for free and redesign their own hardware.

October showed a 110 per cent increase in malware sample collection over the previous month and a 171 per cent increase from what had been collected up to July 2011.

Not only are the numbers going up, but the malicious programmes are getting more sophisticated too.

In its reporter Juniper Networks said: ‘We have since seen exponential grow in Android malware over the last several months.

‘The months of October and November are shaping up to see the fastest growth in Android malware discovery in the history of the platform.

‘The majority of malicious applications target communications, location, or other personal identifying information. 

‘Of the known Android malware samples, 55%, acts in one way or another as spyware.

‘The other major type of attack, which make up 44%, are SMS Trojans, which send SMS messages to premium rate numbers owned by the attacker in the background of a legitimate application, without the person’s knowledge.

‘Once these messages are sent, the money is not recoverable, and the owners of these premium rate numbers are generally anonymous.’

The report adds that the main suspects behind such programmes are the same people who targeted other phones but have shifted because Android is now the most popular operating system.

View the original article here

Lebanese hacker targets Damascus University - The Daily Star

BEIRUT: A Lebanese hacker has targeted the website of Damascus University and posted information and a message saying more government and Syrian education websites will be hacked.

On Sunday afternoon, the hacker wrote on Twitter under the handle idahc_hacker, “Damascusuniversity.edu.sy OWNED,” with a link to a website where he had posted information from the university’s website.

“A message for the dictator Bashar Assad: we will hack many other gov.sy and edu.sy,” he wrote on http://pastebin.com/mhumVcd7.

The usability of the Damascus University website did not appear to be directly affected by the attack.

The hacker, who says he is an 18-year-old computer science student and describes himself as a “Lebanese gray hat hacker” on his Twitter biography, is one of several hackers who have recently targeted Sony in a high-profile campaign, along with the group Anonymous, and the now-disbanded LulzSec group.

The term “gray hat” is used to indicate a hacker who hacks without malicious intent, instead intending to, for instance, highlight a company’s security problems. In a recent interview with Forbes magazine, Idahc said he acted for “moral reasons” during his hacking, and his attacks were intended as a way to “help Sony” with their security vulnerabilities.

The message to Assad therefore marks a slightly more menacing turn for the young hacker, who has expressed disapproval of the work of LulzSec and Anonymous, who have revealed sensitive information of the companies they hack and, in LulzSec’s case, targeted the FBI.

Azzam Mourad, an assistant professor of computer science at Lebanese American University said the type of hack Idahc used could not be used to modify websites.

“It’s really just a message,” Mourad said. “It’s a dumping of information.”

However, he added, it was possible that such methods could be used to damage or to reveal sensitive information should Idahc go on to attack government websites. “At later periods, maybe he could attack the information. If he kept trying,” he said.

View the original article here

Milly Dowler phone 'hacked by News of the World private investigators' - Daily Mail

Dowler family's lawyer says former News of the World editor's position is a 'question for her conscience'Questions over whether it could have hampered police investigation into her disappearance in 2002Labour demands full police probe into allegations

By Chris Greenwood

Last updated at 12:01 PM on 5th July 2011

News International boss Rebekah Brooks's position looked increasingly untenable today as both David Cameron and Ed Miliband condemned the hacking of Milly Dowler's phone.

The Prime Minister described the allegations as a 'truly dreadful act', while Labour leader Ed Miliband urged Brooks to 'consider her position' and "examine her conscience'.

Their words were backed by the Dowler family's lawyer Mark Lewis, who said of Brooks's position: 'It is a matter for her own personal conscience to decide.

Close: Prime Minister David Cameron today condemned the hacking of Milly Dowler's phone by News of the World investigators while his friend Rebekah Brooks, right, was editor

David Cameron, speaking from Kabul this morning, said the hacking, if true, is 'a truly dreadful act'

'We have to wait and see whether she decides to do the honourable thing.'

The condemnation from Mr Cameron is a major blow to Ms Brooks, who considers him a personal friend.

Both have homes in his Oxfordshire constituency and Mr Cameron visited her as a guest during the Christmas period last year.

Their friendship is one of a number the Prime Minister holds with senior media industry figures, who live nearby including Elizabeth Murdoch and Jeremy Clarkson.

It has been claimed that her parents Bob and Sally Dowler also had their phones hacked by a private detective in the weeks after the 13-year-old disappeared in 2002.

Speaking at a press conference in Kabul, Mr Cameron said: 'These are really appalling allegations about the telephone of Milly Dowler.

'If they are true this is a truly dreadful act and a truly dreadful situation.'

Mr Cameron said police investigation the allegations should do so without 'fear or favour'.

He added: 'They should pursue this in the most vigorous way that they can to get to the truth of what happened.'

Today the Dowler family's lawyer Mark Lewis said: 'This is cruel. It is evil that people thought this was the right thing to do.'

The alleged hacking took place when Rebekah Brooks, who now runs the British arm of News International, was editor of the News of the World.

She will not resign over the matter, sources at the organisation said.

Labour leader Mr Miliband said: 'I am shocked by the news of the hacking of Milly Dowler's phone. It beggars belief that anyone would undertake such a cruel and immoral act.

'The police inquiry must get to the bottom of who was responsible for this and who was complicit in it.'

He also criticised the News of the World for the 'culture' that allowed it to happen. He said: 'Of course she (Brooks) should consider her position but this goes well beyond one individual.

'This is about the culture and practices, which were obviously going on at that newspaper, the News of the World, over a sustained period of time.

'Cruel': Investigators for the News of the World are accused of hacking Milly Dowler's voicemail. Ed Miliband has attacked the newspaper for its actions

Operation Weeting is mainly focused on the News of the World's activity during 2005 and 2006, by which time Rebekah Brooks had left the paper fro the Sun.

But the Dowler episode, in March 2002, happened while she was editor.

When she took over the paper in 2000, Brooks brought back Greg Miskiw from New York, shortly after he had been sent there as U.S. correspondent.

She made him her assistant editor in charge of news. It was Miskiw who then hired private investigator Glenn Mulcaire, who proceeded to steal confidential data and hack voicemails.

While Brooks was in the editor's chair, the News of the World also regularly hired Steve Whittamore, who ran a network of specialists who stole information from British Telecom, mobile phone companies and the DVLA.

Records published by the Information Commissioner's Office show that 23 journalists from the News of the World hired Whittamore a total of 228 times (including for the purchase of addresses and ex-directory numbers relating to Milly Dowler's disappearance).

Journalists who worked at the News of the World say that their use of private investigators was routine, open and officially sanctioned.

The former showbusiness reporter, Sean Hoare, who worked there under Brooks, last year told the New York Times that he was actively encouraged to hack into voicemail by her deputy, Andy Coulson.

One of Brooks's assistant editors, Paul McMullan, told the Guardian last year that he personally had commissioned several hundred acts that could be regarded as unlawful - which senior editors were of.

'It wasn't about a rogue reporter, it wasn't just one individual, this was a systematic series of things that happened.

'What I want from executives at News International is for them to start taking responsibility for this.'

He added: "They (the public) will be horrified that the grieving parents of an abducted child were made to go through further torture that somehow she was alive because her voicemails were being retrieved or deleted.

'People will ask "where have we got to?" that that was thought to be an acceptable way for parts of the British press to behave.

'My wife said to me this morning "this is sick, what was going on" and I think that is going to be the reaction of people up and down this country.'

Asked if the Prime Minister backed the Labour leader's call, a Downing Street spokesman said: 'We should await the outcome of the police investigation into phone hacking.'

Mr Miliband's words were echoed by shadow Home Secretary Yvette Cooper.

She said: 'Everyone across the country will be deeply disturbed and horrified at this shocking news. The idea that private investigators working for a newspaper would hack into the phone of a missing 13-year-old girl is truly despicable.

'It is deeply distressing that the Dowler family, who have already been through so much, should now have to go through yet another media ordeal.

'I am now seeking immediate assurances that these actions did not affect the police inquiry into Milly Dowler's disappearance.'

Bob and Sally Dowler's solicitor, Mark Lewis, said the 'heinous' actions could have jeopardised the police inquiry as messages were deliberately deleted from Milly's phone to create space for new ones.

This meant her parents clung to 'false hope' that she was still alive because police wrongly thought she was erasing voicemails when, in fact, she was already dead.

At the time she vanished in March 2002, they had been sending desperate text messages and voicemails to her. They now fear those pleas were listened to by the hackers.

Police believe that if Milly's abductor had been accessing the phone at the time of the hunt for her, those deleting the messages may have destroyed potential evidence.

It is alleged the hackers deleted the messages because Milly’s phone - an old model - had a limited memory, meaning no more voicemails could be left.

Controversy:  Rebekah Brooks (left) was editor of the News of the World at the time of the allegations while her predecessor Andy Coulson (right) resigned earlier this year as David Cameron's Director of Communications as a result of the phone hacking scandal

Grief-stricken: Bob and Sally Dowler with daughter Gemma, centre, speaking outside court after Bellfield's conviction

Mr Lewis said her parents had already been through 'so much grief and trauma' before these 'further distressing revelations'.

Last month they revealed how traumatised they had been by the trial that led to the conviction of Levi Bellfield, 43, for Milly's murder.

Mr and Mrs Dowler said they were in effect put on trial as their personal lives were torn apart in the witness box.

'It is distress heaped upon tragedy to learn the News of the World had no humanity at such a terrible time,' said Mr Lewis.

'The fact that they were prepared to act in such a heinous way that could have jeopardised the police investigation and give them false hope is despicable.'

The Dowler family were only told about the hacking in April - more than nine years after their daughter went missing.

Her remains were found 25 miles away from her home in Walton-on-Thames, Surrey, in September 2002.

Abuse: Bellfield is seen here with his former girlfriend Johanna Collings at Yateley Heath - where Milly's body was found years later

Grief: Flowers are laid for schoolgirl Milly Dowler outside Heathside School, Weybridge, in September 2002 after her body was found

Grieving: Parents of Milly Dowler, Bob and Sally, make an appeal during the time of her disappearance in 2002

A source close to the inquiry said officers were 'shell shocked' when they learnt about the hacking. 'This is devastating news for the family,' he said.

'When the trial finished they wanted to reclaim the memory of Milly for themselves. But this has thrown it open again.'

Police sources said they did not know what journalists hoped to achieve by the alleged hacking of Milly's phone. But it is possible they were after fresh leads in the search for her.

It also emerged yesterday that Colin Stagg, the man cleared of murdering Rachel Nickell, may have been hacked as early as 2000.

The latest revelations are likely to mark a turning point in Operation Weeting, Scotland Yard's investigation into hacking at the News of the World, in which five people have been arrested.

Detectives found evidence of the Dowler hacking amid paperwork seized from the home of private investigator Glenn Mulcaire, who was jailed in January 2007, along with former News of the World royal editor Clive Goodman, for intercepting voicemail messages.

Scotland Yard was first alerted to phone hacking in 2005 when royal aides reported their suspicions to police.

After the conviction of Goodman and Mulcaire, concerns were raised that the initial inquiry was too limited.

In January Scotland Yard announced a new inquiry after detectives were handed 'significant new information' by News International.

News International has reportedly set aside a multi-million pound fund to settle compensation claims with victims. They include actress Sienna Miller, who was recently paid ?100,000, and sports pundit Andy Gray, who received ?20,000.

A spokesman for News International said: 'We have been co-operating fully with Operation Weeting since our voluntary disclosure in January restarted the investigation into illegal voicemail interception.

'This particular case is clearly a development of great concern and we will be conducting our own inquiries as a result. We will obviously co-operate fully with any police request on this should we be asked.'

Killer: Levi Bellfield, pictured in 2011 (left) and 2004 (right) was convicted of murdering Milly Dowler

View the original article here