HP's Nonpology

The "nonpology" is a corporate standard: a company does something terrible, and then it tells you it's sorry that you found its behaviour upsetting. But HP's October 2016 public statement on its secret, aftermarket attack on its customers' property has made important advances in the field of nopologyology.

Three states considering "right to repair" laws that would decriminalize fixing your stuff

Section 1201 of the 1998 Digital Millennium Copyright Act makes it both a crime and a civil offense to tamper with software locks that control access to copyrighted works -- more commonly known as "Digital Rights Management" or DRM. As the number of products with software in them has exploded, the manufacturers of these products have figured out that they can force their customers to use their own property in ways that benefit the company's shareholders, not the products' owners -- all they have to do is design those products so that using them in other ways requires breaking some DRM. Read the rest

Houseguests, technological literacy, and the goddamned wifi: a single chart

Randal Munroe nails it again in an XKCD installment that expresses the likelihood that your houseguests will be able to connect to your wifi (I confess to having been the "firmware" guide -- but also, having been reminded to do something about my own firmware when other difficult houseguests came to stay). Read the rest

Chrysler's Dieselgate: 100,000 Chrysler trucks said to have emissions "defeat devices"

The EPA and the California Air Resources Board (CARB) say that since 2014, Chrysler shipped 104,000 trucks with "defeat devices" designed to cheat emissions tests -- like VW's cheating, this software was designed to produce low NOx ratings when the trucks were undergoing emissions tests, but to ramp up NOx emissions during normal road use, trading emissions for fuel-efficiency. Read the rest

FBI arrest the VW executive who stonewalled on the first Dieselgate reports for defrauding the US Government

Oliver Schmidt led Volkswagen regulatory compliance office from 2014 to Mar 2015, and it was he who issued statements dismissing the initial West Virginia University reports of cheating in the emissions control systems of the company's cars, lying to US regulators and insisting that the systems were merely buggy, and not deliberately designed to get around emissions testing; after the company admitted to the fraud, he appeared before the British Parliament and insisted that the fraud didn't violate EU law. Read the rest

This NES Classic jailbreak is a perfect parable of our feudal future of disobedient dishwashers

Nintendo's nostalgic instant sellout NES Classic (still available from scalpers) only comes with 30 games and no way to add more: but it only took two months from the announcement date for intrepid hackers to jailbreak the device and come up with a way to load your favorite ROMs, using a USB cable and a PC.

Chinese social media went a-flutter at this photo of an apparent App Store clickfarmer

This year-old photo of a woman seated at a wall of Iphones went viral on Chinese social media, where it was identified as a clickfarmer whose job is to repeatedly install apps on multiple phones in order to inflate their App Store ranks. Read the rest

Your smart meter is very secure (against you) and very insecure (against hackers)

In On Smart Cities, Smart Energy, And Dumb Security -- Netanel Rubin's talk at this year's Chaos Communications Congress -- Rubin presents his findings on the failings in the security of commonly deployed smart meters. Read the rest

Free audiobook of Car Wars, my self-driving car/crypto back-door apocalypse story

Last month, Melbourne's Deakin University published Car Wars, a short story I wrote to inspire thinking and discussion about the engineering ethics questions in self-driving car design, moving beyond the trite and largely irrelevant trolley problem. Read the rest

PWC threatens to sue security firm for disclosing embarrassing, dangerous defects in its software

ESNC, a German security research firm, discovered a critical flaw in PWC's enterprise software, which would allow attackers to hack into PWC customers' systems; when ESNC gave PWC notice of its intent to publish an advisory in 90 days, PWC promptly threatened to sue them if they did. Read the rest

The Mirai worm is gnawing its way through the Internet of Things and will not stop

The Mirai worm made its way into information security lore in September, when it was identified as the source of the punishing flood of junk traffic launched against Brian Krebs in retaliation for his investigative reporting about a couple of petty Israeli criminals; subsequent analysis showed Mirai to be amateurish and clumsy, and despite this, it went on to infect devices all over the world, gaining virulence as it hybridized with other Internet of Things worms, endangering entire countries, growing by leaps and bounds, helped along by negligent engineering practices at major companies like Sony. Read the rest

The kickstarted Pebble smartwatch is now a division of Fitbit, so they may "reduce functionality" on all the watches they ever sold

If you're one of the 60% of Pebble employees who didn't get a job offer from Fitbit, the company's new owner, you're probably not having a great Christmas season -- but that trepedation is shared by 100% of Pebble customers, who've just learned (via the fine print on an update on the Pebble Kickstarter page) that the company may soon "reduce functionality" on their watches. Read the rest

Not just crapgadgets: Sony's enterprise CCTV can be easily hacked by IoT worms like Mirai

The unprecedented denial-of-service attacks powered by the Mirai Internet of Things worm have harnessed crappy, no-name CCTVs, PVRs, and routers to launch unstoppable floods of internet noise, but it's not just faceless Chinese businesses that crank out containerloads of vulnerable, defective-by-design gear -- it's also name brands like Sony. Read the rest

W3C at a crossroads: technology standards setter or legal arms-dealer?

The World Wide Web Consortium (W3C) is an amazing, long-running open standards body that has been largely responsible for the web's growth and vibrancy, creating open standards that lets anyone make web technology and become part of the internet ecosystem. Read the rest

My keynote from the O'Reilly Security Conference: "Security and feudalism: Own or be pwned"

Here's the 32 minute video of my presentation at last month's O'Reilly Security Conference in New York, "Security and feudalism: Own or be pwned." Read the rest

Car Wars: a dystopian science fiction story about the nightmare of self-driving cars

Melbourne's Deakin University commissioned me to write a science fiction story about the design and regulation of self-driving cars, inspired by my essay about the misapplication of the "Trolley Problem" to autonomous vehicles. Read the rest

A lightbulb worm could take over every smart light in a city in minutes

Researchers from Dalhousie University (Canada) and the Weizmann Institute of Science (Israel) have published a working paper detailing a proof-of-concept attack on smart lightbulbs that allows them to wirelessly take over the bulbs from up to 400m, write a new operating system to them, and then cause the infected bulbs to spread the attack to all the vulnerable bulbs in reach, until an entire city is infected. Read the rest

More posts