Boing Boing 

Bruce Sterling's "The Epic Struggle of the Internet of Things"

It's a new long-form essay in the tradition of Sterling's must-read, groundbreaking 2005 book Shaping Things, a critical perspective on what it means to have a house full of "smart" stuff that answers to giant corporations and the states that exert leverage over them.

Read the rest

Tabnapping: a new phishing attack [2010]

Aza Raskin's Tabnapping is a proof-of-concept for a fiendish attack: a tab that waits until you're not watching, then turns itself into a convincing Google login screen that you assume you must have opened.

Read the rest

In the Interests of Safety: using evidence to beat back security theater

“Health and Safety” is the all-purpose excuse for any stupid, bureaucratic, humiliating rubbish that officialdom wants to shove down our throats. In the Interests of Safety, from Tracey Brown and Michael Hanlon, is the antidote: an expert dismantling of bad risk-analysis and a call-to-arms to do something about it, fighting superstition and silliness with evidence.

Read the rest

Fake, phone-attacking cell-towers are all across America


The towers attack the baseband radio in your phone and use it to hack the OS; they're only visible if you're using one of the customized, paranoid-Android, post-Snowden secure phones, and they're all around US military bases.

Read the rest

When law-enforcement depends on cyber-insecurity, we're all at risk


It's not enough to pass rules limiting use of "stingray" mobile-phone surveillance devices by civilians: for so long as cops depend on these devices, the vulnerabilities they exploit will not be fixed, leaving us all at risk.

Read the rest

Trundling lidar-guided printerbot will find you and deliver your hardcopy


A Fuji-Xerox prototype printer-robot builds a model of the room and then drives itself to your desk to deliver your printouts, saving you the precious calories you'd waste, running around the office, trying to figure out which printer you sent your job to.

Read the rest

3D printed bump keys make short work of high-security locks

High-end locks rely on their unique key-shapes to prevent "bumping" (opening a lock by inserting a key-blank and hitting it with a hammer, causing the pins to fly up), but you can make a template for a bump key by photographing the keyhole and modelling it in software.

Read the rest

Google Images hacked


Google's Image Search has apparently been hacked. All queries return a line or two of normal images, followed by thousands of differently-sized versions of the image above, depicting a grisly car-crash ganked from a Ukrainian news site's coverage of the wreck.

Read the rest

USB Condom: charge your devices without allowing sneaky data-transfers


Those public USB charging points are tempting, but could be used to propagate all kind of grotesque malware (imagine what happens when your phone's camera, mic, storage, keyboard and GPS start leaking your data to voyeurs and identity thieves) -- sure, you can always buy a charge-only cable, but these crowdfunded adapters turn any cable into a power-only source.

Read the rest

Cybersecurity czar is proud of his technical illiteracy

Michael Daniel thinks "being too down in the weeds at the technical level could actually be a little bit of a distraction"; Ed Felten counters, "Imagine reaction if White House economic advisor bragged about lack of economics knowledge, or Attorney General bragged about lack of legal expertise."

Read the rest

Save the net, break up the NSA

Bruce Schneier nails it: "efficiency is not the most important goal here; security and liberty are."

Read the rest

A video about cybersecurity that you should really watch

Dan Geer's Black Hat 2014 talk Cybersecurity as Realpolitik (also available as text) is thoughtful, smart, vital, and cuts through -- then ties together -- strands of security, liability, governance, privacy, and fairness, and is a veritable manifesto for a better world.

Read the rest

Uber-like service for private security

94bd8a8bd3e856a5b2ddc43862f56a0f

The task routing craze continues with Bannerman, an on-demand private security force that promises to send muscle your way in around 30 minutes. The booking process is similar to Uber and the company says the guards "have passed background checks by the FBI & the department of Justice" and have "physical presence for visual deterrence." Now available in the SF Bay Area with other cities coming soon. (Thanks, Adam Shandobil!)

Journalist believes his phone was hacked by spooks at HOPE X, will upload image for forensics


Douglas writes, "My rooted CyanogenMod phone got hacked at HOPE X. I'm planning to get it write-blocked and imaged to crowdsource forensics."

Read the rest

Back doors in Apple's mobile platform for law enforcement, bosses, spies (possibly)

Jonathan Zdziarski's HOPE X talk, Identifying Backdoors, Attack Points, and Surveillance Mechanisms in iOS Devices, suggests that hundreds of millions of Iphone and Ipad devices ship from Apple with intentional back-doors that can be exploited by law enforcement, identity thieves, spies, and employers.

Read the rest

EFF unveils secure, sharing-friendly, privacy-minded router OS

As promised, the Open Wireless Movement's new sharing-friendly, privacy-minded router operating system was unveiled at HOPE X in New York last weekend.

Read the rest

Fake TSA screener infiltrates SFO checkpoint, gropes women


He was allegedly drunk, and had at least two victims before SFO's crackerjack private aviation security outfit, Covenant, noticed (they're the same ones who smashed my brand new camera some years ago and refused to take responsibility for it).

Read the rest

Digital First Aid Kit: where to turn when you're DoSed or have your accounts hijacked

A group of NGOs, including the Electronic Frontier Foundation, offer a suite of tools for diagnosing and mitigating the kinds of attacks faced by dissidents and independent media all over the world, especially when they threaten the powerful.

Read the rest

Google's badass "Security Princess" profiled


Parisa Tabriz 's title at Google is "Security Princess" -- meaning that she runs the adversarial internal team tasked with continuously testing and probing Google's security to find flaws before the enemy does.

Read the rest

Fake Google subdomain certificates found in the wild

An Indian certificate authority in the Microsoft root of trust has been caught issuing fake Google subdomain certificates that would allow nearly undetectable eavesdropping on "secure" connections to services like Google Docs.

Read the rest

Google Maps' enduring security holes put businesses at risk


It's been more than a year since a series of high-profile articles demonstrated that Google Maps' crowdsourcing function can be used create new listings, alter existing business listings, and even create fake Secret Service offices that real-life cops end up calling.

Read the rest

"Personal Internet security" is a team sport


My latest column in Locus magazine, Security in Numbers, looks at the impossibility of being secure on your own -- if you use the Internet to talk to other people, they have to care about security, too.

Read the rest

ISPs sue UK spies over hack-attacks


ISPs in US, UK, Netherlands and South Korea are suing the UK spy agency GCHQ over its illegal attacks on their networks in the course of conducting surveillance.

Read the rest

UK cinemas ban Google Glass from screenings


UK cinema exhibitors -- which already makes a practice of recklessly confiscating mobile phones full of sensitive, unprotected data during preview screenings -- have announced that it will not allow Google Glass wearers into cinemas, lest they commit an act of piracy (Glass has a 45 minute battery life when in recording mode).

Read the rest

Cyber-crooks turn to Bitcoin extortion


Security journalist Brian Krebs documents a string of escalating extortion crimes perpetrated with help from the net, and proposes that the growth of extortion as a tactic preferred over traditional identity theft and botnetting is driven by Bitcoin, which provides a safe way for crooks to get payouts from their victims.

Read the rest

Charlie Stross on the stop/go nature of technological change

Charlie Stross's keynote speech to the Yet Another Perl Conference is an inspired riff on the weird, gradual-then-sudden nature of technological change. As Charlie points out, almost everything today -- including the people -- was around 20 years ago, and most of what's around now will be around in 20 years. But there will be some changes that would shock your boots off. Improbably, he manages to tie this all into perl programming, which, apparently, is the future of smart sidewalks. Charlie's thoughtfully provided a transcript of his talk, and there's a video for those who prefer to hear his rather good comic delivery.

Read the rest

Cops bust cybercrook who sent heroin to Brian Krebs

Sergei "Fly" Vovnenko, a Russo-Ukrainian cybercrook who stalked and harassed security journalist Brian Krebs -- at one point conspiring to get him arrested by sending him heroin via the Silk Road -- has been arrested. According to Krebs, Vovnenko was a prolific credit-card crook, specializing in dumps of stolen Italian credit-card numbers, and faces charges in Italy and the USA. Krebs documents how Vovnenko's identity came to light because he installed a keylogger on his own wife's computer, which subsequently leaked her real name, which led to him.

Read the rest

Researchers publish secret details of cops' phone-surveillance malware


Kaspersky Labs (Russia) and Citizen Lab (University of Toronto) have independently published details of phone-hacking tools sold to police departments worldwide by the Italian firm Hacking Team (here's Kaspersky's report and Citizen Lab's). The tools can be used to attack Android, Ios, Windows Mobile and Blackberry devices, with the most sophisticated attacks reserved for Android and Ios.

The spyware can covertly record sound, images and keystrokes, capture screenshots, and access the phones' storage and GPS. The tools are designed to detect attempts to search for them and to delete themselves without a trace if they sense that they are under attack.

Hacking Team insists that its tools are only sold to "democratic" police forces, but Citizen Lab's report suggests that the tool was used by the Saudi government to target dissidents.

The means of infection is device-specific. If police have physical access, it's simple. Android devices can be attacked by infecting a PC with a virus that installs the police malware when the device is connected to it. This attack also works on jailbroken Iphones.

Read the rest

Anti-forensic mobile OS gets your phone to lie for you

In Android Anti-forensics: Modifying CyanogenMod Karl-Johan Karlsson and William Bradley Glisson present a version of the Cyanogenmod alternate operating system for Android devices, modified so that it generates plausible false data to foil forensic analysis by law enforcement. The idea is to create a mobile phone that "lies" for you so that adversaries who coerce you into letting them take a copy of its data can't find out where you've been, who you've been talking to, or what you've been talking about.

I'm interested in this project but wonder about how to make it practical for daily use. Presently, it maintains a hidden set of true data, and a trick set of false data intended to be fetched by forensic tools. Presumably, this only works until the forensic tools are modified to spot the real data. But you can conceptually imagine a phone that maintains a normal address book and SMS history, etc -- all the things that are useful to have in daily use -- but that, on a certain signal (say, when an alternate unlock code is entered, or after a certain number of failed unlock attempts) scrubs all that and replaces it with plausible deniability data.

Obviously, this kind of thing doesn't work against state-level actors who can subpoena (or coerce) your location data and call history from your carrier, but those people don't need to seize your phone in the first place.

Read the rest

US appeals court rules a warrant is required for cell phone location tracking

logo25

Big news in the fight for security and privacy in the US: the 11th Circuit Court of Appeals this week ruled that a warrant is required for cell phone location tracking.

Read the rest