Month: February 2018

How Driverless Cars will put Mobile Security to the Test?

Posted on by io-fund

As GM CEO Mary Barra said in a keynote speech, “A cyber incident is a problem for every automaker in the world. It is a matter of public safety.” As Tesla, GM and many others continue to release connected vehicles – and soon driverless vehicles, the dangers are set to increase. In fact, more than half of the vehicles sold today are connected and vulnerable.

By 2025, the driverless market will be worth $42 billion up from nearly nothing with an official market entry still being anticipated [1]. Self-driving cars have the potential to save 292,000 lives annually from preventing collisions. This is in addition to the added benefits of reducing traffic and climate change, along with the costs of car ownership.

While gaining access to, and being able to control or steal a vehicle such as a Tesla is disturbing enough, it raises several concerns about not only connected cars, but also the mobile applications that extend the features of these vehicles. In fact, mobile apps are quickly becoming the main target for malicious behavior. Over the last four years, there has been a 188 percent increase in the number of Android vulnerabilities and a 262 percent increase in the number of iOS vulnerabilities. In addition, according to Gartner, 75 percent of mobile apps would fail basic security tests.

In another report, more than 80 percent of mobile apps on both the Android and iOS platforms revealed cryptographic implementation issues. Recently, Android malware has become more stealth and has begun to obfuscate code to bypass signature-based security software. Despite Google’s response to critical vulnerabilities and patches of critical issues in the Android OS, end users are still dependent on device manufacturers for these updates.

Driverless Car Security Infographic:

Driverless Car Security Infographic

The main source of security and data breaches are found in hacking, malware and social engineering [2].

There are four major attack clusters in the automotive sector:

  • Direct physical attack: Cars can be breached through the OBDII port and/or while in for maintenance or lent to other drivers.
  • Indirect physical attack: A carrier is used to compromise the vehicle such as a USB stick, SD card, or through a software patch.
  • Wireless attacks: Bluetooth and mobile networks including the current development of iOS and Android apps open up the vehicle to an abundant variety of attacks.
  • Sensor fooling: As of yet, there are no known hacks documented that indicate you can take over a car by fooling the sensors alone.

Consumers are becoming more aware of the dangers around connectivity with 62% saying they are concerned that connected cars will become easily hacked in the future and 48% saying data privacy and security are extremely important. Executives of car manufacturers are also aware of the heightened concern with 52% rating data security and privacy as being of upmost importance to their customers [3].

While the path towards better cyber security for connected cars is a multi-actor road map, auto manufacturers who take the lead will be improving the security of their own brand and product will also improve the safety of their customer.

Are FinTech Solutions Safe on Mobile?

Posted on by io-fund

We live in a digital world where almost everything we touch is being stored on servers, the cloud or in mobile applications. Technologists push for the adoption of digital services and applications while consumers push back for safety and fraud protection. Fintech solutions on mobile are in a predicament; on one-hand these solutions offer the premium convenience of making deposits and transfers on-the-go, and the on the other hand, it digitizes and potentially sells off a person’s most valuable possession: their wallet.

Banks and financial institutions have quite a bit to gain – especially on a global level. Although still in its early stages, the cumulative investment for FinTech in 2017 is forecast to be $150 billion.

FinTech Solutions on Mobile – Hacks Worth up to $25 Billion

“White hat” hackers (the good guys), such as security researcher Sathya Prakash, have been known to expose hacks worth up to $25 billion by taking money out of one of India’s largest banks with just a few lines of code. “I could’ve done this with anybody’s account,” Prakash told reporters at Motherboard – all he needed was an account number. While this hack had a happy ending, with a quick patch and no money lost, not all hacks do. According to Lookout, a mobile security and antivirus firm, as many as 3 percent of Android users have encountered a mobile threat in the past year [1]. This may seem like a small number, but when you consider well-known financial institutions have over 50,000 employees (and some that have over 150,000 employees like Chase or Wells Fargo), the math comes out to 1,500 to 4,500 employees who are potentially introducing risks through their mobile device operating system.

FinTech Solutions on Mobile – Reach Millennials through Mobile Banking

Millennials are digital natives and have become mobile FinTech power users with 87% of those aged 18-35 using mobile services. 71% of them expect mobile banking to transform their future. In fact, Millennials are using mobile banking 8.5 times per month compared to 3.1 times per month for the average mobile banking user. Across all age groups, 60% state mobile banking is the #1 reason for switching banks.

You can access more statistics in the Infographic below.

FinTech Solutions on Mobile – Public Perception of Mobile Banking Security is Low

For those who do not use mobile banking, 57% state it’s because they believe mobile banking is not safe, and 61% cite security as the #1 reason for not using mobile banking. In fact, only 2% of mobile banking users believe it to be “very safe” while more than 50% believe it to be somewhat unsafe or very unsafe [2]. Global financial institutions are doing their best to protect themselves by introducing features such as biometric authentication, 2 Factor Authentication, end-to-end encryption, and AI fraud scanning. Convincing customers to use and embrace these technologies is essential as research shows that users will quickly leave a bank they do not trust.

In addition to building all these technical solutions to solve real security problems, the very real issue of convincing the public to trust a particular financial institution with their assets is a moving target and perhaps a more difficult challenge.

To those who figure this out, leadership of the future financial markets await.

Sources:

[1] https://www.nbcnews.com/storyline/hacking-in-america/new-way-you-ll-get-hacked-through-banking-app-your-n651571
[2] https://www.federalreserve.gov

Should We Build a Backdoor into Mobile Devices?

Posted on by io-fund

Two years ago the San Bernardino shooting stirred a debate within the security community regarding warrant-proof encryption. The debate, known as “mobile backdoor access,” refers to exceptional access to encrypted communications and data by law officials. In theory, the Department of Justice wants technologists to “hide a key under the door mat” for law officials to access when they have the proper warrants. However, many security professionals and technologists have resisted this request due to creating weaknesses that are irreversible and require falsified automatic updates which may introduce other vulnerabilities.

Perhaps the biggest conflict for technologists, as pointed out by Herbert Lin, the Senior Research Scholar of Cyber Policy and Security at Stanford, is that anything less than deploying the best security (that is technologically possible) could constitute a neglect of professional obligation and ethics. Last November at the Intertrust LINE event, I had the opportunity to interview Lin, who is on the front lines of this debate. The conflict, as he pointed out in his keynote, exists in whether you can technologically design a system allowing exceptional access that is also secure. The security community says this is not possible while law enforcement says it is possible. Lin argues the parties are not talking about the same thing, as to talk about the same thing will require less-than-maximal security for users and less-than-desired capability for law enforcement (the proverbial grey area). In other words, maximal security is a technology issue, and adequate security is a policy issue — and it’s impossible to use a technical argument to solve policy.

Watch this 2 minute clip by Herbert Lin briefly covering the topic of mobile backdoor access: “Should We Build a Backdoor Into Mobile Devices?”Should We Build a Backdoor Into Mobile Devices?”

In his keynote, Lin poses questions that all sides must eventually answer during this debate and inevitable compromise, including tech vendors and the privacy community.

Questions we must answer for mobile backdoor access:

Questions for Law Enforcement:

· Why is law enforcement unwilling to acknowledge they’re asking the public to accept a lower level of cybersecurity?

· Why has a technical proof of concept not been provided? You think it can exist. Then prove it.

· How often and for what purposes are exceptional access capabilities expected to be used? If it begins for terrorism, when will it end?

Questions for Tech Vendors:

· Why do vendors provide password features if they’re against backdoors? This proves there situations where technologists have decided the benefits outweigh the consequences.

· How would exceptional access stifle innovation? Why should information technology not be subject to regulation? Lin points out technology is often subject to regulatory measures such as seat belts in cars.

Questions for the Privacy Community:

· What is the actual harm of having a back door? There are many people who are worried about being harmed that would not actually be harmed.

· How often are improper exceptional accesses expected to occur? The privacy community has the understanding there are to be zero improper uses, while one in 1 million or one in 10 million is more reasonable.

Click here to view the full keynote by Herbert Lin, entitled “Unresolved Issues Regarding Exceptional Access to Encrypted Data and Communications.”

Thanks for reading.

p.s. Don’t forget to follow me if you enjoyed this article!  On Twitter @Beth_Kindig and on Medium 

Are Technologists Ready for the Data Commodity of Ambient Intelligence?

Posted on by io-fund

Savvy consumers today are aware that marketers and corporate companies mine personal data from mobile phones and computers, sourced primarily from search engines, social media sites, emails, text messages, and GPS location information. The internet, a free virtual public space idealized in the nineties, has become colonized through a swath of promised conveniences. In the beginning, the lure of free, convenient services for data was enticing.  The improvement in user experience when checking email in the cloud was great enough so as not to elicit questions as to how the emails were handled – such as when Google launched Gmail in 2004, adding a second signal to enrich the profile of search engine users through personally identifiable information. GPS tracking has also since become a powerful method of gathering information on an individual. E-commerce sites advertise by dropping cookies to track online behavior. Thermostats, in a promise to lower heating bills, track data on how people behave inside their homes. But the underpinnings of demand for data by marketers and big corporations remains obscure to most individuals. What is the value of this data and is the digital privacy of individuals a fair trade for the use of internet services and applications?

Ambient Intelligence: A Higher Level of AI Cognition

Many believe that technology’s dominance over privacy is inevitable.  Today, humans in developed countries occupy a mixed digital and physical space, one that is largely driven by automatic collection, trading and analysis of information with little or no effort to protect the fundamental rights and liberties of those who use the technology. As the physical and digital worlds merge, digital privacy is no longer a right, but rather a commodity to be traded and sold – meanwhile, physical privacy continues to be protected.

Technology is simply moving faster than policy mechanisms, and this allows technologists to impose their own rules. Big data has fueled a sharp uptick in data mining and profiling with the intent to predict human behaviors and preferences. A White House report released in October 2016 notes that big data is actually the precursor to artificial intelligence and that the availability of big data from e-commerce, businesses, social media, and science have “…provided the raw material for dramatically improved machine learning approaches and algorithms.”

Once interoperability evolves for the many facets of the Internet of Things, along with a higher level of AI cognition, ambient intelligence will emerge. In a world of ambient intelligence, devices work seamlessly to carry on life activities using information and devices hidden in the network. The devices will grow smaller and become more integrated into the environment. Imagine an AI-powered assistant delivering products and services to you the instant they are required; whether it’s a ride when you leave the airport, replacing the groceries you’ve eaten earlier in the week, or ordering your drycleaning. The point for the bots and sensors will be to learn and know as much about your personal habits as possible to increase convenience.

Clearly, technologists have some responsibility that is absent from the current discussion on AI and ambient intelligence. The general population may not demonstrate substantial concern (or understanding) to change its behavior or modify its choices, but that doesn’t mean that these mechanisms should go unchecked.  Higher order thinking makes the case that people (and society) need more control over personal information, including any machines placed to observe, construct or produce knowledge on an individual.

 

What is the Value of Privacy – and do Consumers care?

“Control over personal information is control over an aspect of the identity one projects to the world, and the right to privacy is the freedom from unreasonable constraints on the construction of one’s own identity.” –Philip Agre

Gartner predicts that by 2018, 50 percent of business ethics violations will occur because of the improper use of big data and analytics.  At the same time, some companies have railed against this, taking steps to distinguish themselves under a banner of data ethics.  Services such as Whatsapp and Signal have shunned data collection entirely by using end-to-end encryption. This decision has helped eliminate potential liability in handling sensitive, personal data, because it simply isn’t retained.

However, not every company can grow – let alone survive – without some level of data science. Big data is the fuel source even as the “engines” such as mobile, artificial intelligence and ambient intelligence become more sophisticated and subtle in their operations. In this case, data platforms are driving these decisions, and those that have a policy for privacy ethics will statistically deliver more value as marketers, startups and corporate companies alike need to connect with consumers without creeping them out.

These proactive decisions can help to sway the perspective of consumers, especially in a competitive space. According to a study by The University of Pennsylvania, more than half of Internet users are concerned about protecting privacy, but feel it may be too late. According to Pew, 74% of Americans say it is “very important” to be in control of their personal information. Meanwhile, according to Chapman University, Americans’ number-one fear is of man-made disasters (e.g., terrorist attacks).  A close second is the tracking of personal data by government and corporations, outranking concerns about crime, the environment and natural disasters.

At this point, to say that consumers “do not care about privacy” is to dodge the ethical responsibility that comes with collecting data. As technology advances to include our immediate surroundings, the discussion around big data deepens as it may affect identity and lessen autonomy. In the future, those who handle data as an intermediary– which means delivering the necessary data to first-party companies while buffering and protecting the information collected on consumers – will fare better professionally than those who approach sensitive information like a commodity.

IoT Medical Devices: Our Scariest Security Threat Yet

Posted on by io-fund

IoT medical devices may be our scariest security threat yet. Implanted devices such as pacemakers draw big headlines for security threats. However, there are 36,000 other health-care related devices in the United States that are discoverable on the connected device search engine Shodan – which doesn’t even take into account the global level of unprotected devices (source: Wired).

In fact, U.S. hospitals have an average of ten to 15 connected IoT medical devices per bed with some hospitals registering 5,000 beds (or 50,000 connected devices). Therefore, the magnitude of the risks associated with these medical IoT devices is a gripping proposition.

Most hacks will not be a life or death situation, although a few exposed vulnerabilities could be potentially fatal, such as with Johnson & Johnson’s insulin pumps, which could potentially administer a fatal dose of insulin, or the Animas OneTouch Ping with a vulnerable wireless controller. The most common hack is for medical records, which can be sold on a Dark Web aftermarket with a value of $500 per Medicare or Medicaid record [2] . As The Hill reports, tens of millions of electronic health records have been compromised over the last few years, whereas there has not been a single implant device death or documented patient harm, according to Zach Rothstein, associated vice president of the Advanced Medical Technology Association. In 2015 over 113 million personal health records were compromised, up 9x from 2014, according to the Department of Health and Human Services (DHS).

While medical record theft and device hacks are well documented, there are many reasons hackers target the vast array of medical devices on the market. Ransomware is the practice of taking over a mobile app until a ransom is paid. A similar exploit can be performed on hospitals by entering a weak point, such as unsecured wireless connections, to access the system and take it over for a ransom. For instance, the Los Angeles Hollywood Medical Center had to pay hackers $17,000 to regain control of critical computer systems [3] . A similar attack also occurred in Mount Pleasant, Texas, where a hospital had its core electronic medical system knocked offline until a ransom was paid. According to those in the security industry, while ransomware attacks are prevalent, they are rarely made public for a variety of reasons.

Other reasons hacks that can occur include changing medical records for allergies or diagnoses. There is at least one case where medical devices were hacked to disseminate information and change stock prices, such as with Muddy Waters, a short selling firm that hired a boutique cybersecurity firm to conduct test attacks on a St. Jude’s pacemaker from 10 feet (3 meters) away, but up to 100 feet with an antenna and software defined radio, according to Reuters.

Medical devices extend beyond healthcare facilities and now overlap with mobile apps, as well. Last year, the Medicines and Healthcare products Regulatory Agency (MHRA) has issued updated guidance today to help identify health apps that are medical devices – and how to secure these mobile vulnerabilities. The apps that are of concern gather data from either the person or a diagnostic device, collecting information such as heartbeat or blood glucose levels, and then interpret the data to make a diagnosis, or to recommend treatment4 . As the MRHA director of medical devices says, “We live in an increasingly digital world, both healthcare professionals, patients and the public use software and stand-alone apps to aid diagnosis and monitor health.” There are also many apps connected to medical devices, providing another entry point for hackers.

“Mobile apps are unleashing amazing creativity,” Bakul Patel said from the FDA’s Center for Devices and Radiological Health. “At the same time, we have set risk-based priorities and are focusing FDA’s oversight on mobile apps that are devices for which safety and effectiveness are critical.”

This article first appeared on Intertrust.comIntertrust.com

To learn more on how to protect IoT Medical Devices and how Intertrust drives advancements in healthcare with secure data collaborations, data privacy and security, contact sales@whitecryption.com Intertrust drives advancements in healthcare with secure data collaborations, data privacy and security, contact sales@whitecryption.com 

SOURCES:

[1] WIRED, Medical Devices Next Security Nightmare

[2] NextGov, This Is the Real Threat Posed by Hacked Medical Devices at VA

[3] NYTimes,  Los Angeles Hackers Pay $17,000 After Attack

Cybersecurity in Connected Vehicles Becomes Safety Feature for New Cars

Posted on by io-fund

New car firms such as Tesla are promoting increasingly high-tech features that require a connection to the internet, which has propelled cybersecurity in connected vehicles forward as a major safety feature. Last year, Chinese security researchers from Keen Security Lab successfully managed to hack a Tesla Model S from 12 miles away. By focusing on Tesla’s on-board software, the hack targeted the car’s controller area network, or CAN bus, which connects the chips found inside the cars. In this hack, the Model S P85 and Model 75D were targeted. Tesla continued to make news in 2015 for safety concerns in cybersecurity of connected vehicles. In November 2016, security personnel from the Norwegian company Promon were able to use the Tesla’s Android app as an entry point to successfully hack the vehicle. What’s more, using the features in the app, the hackers were able to locate the vehicle, unlock it and drive away unhindered.

As GM CEO Mary Barra said in a keynote speech, “A cyber incident is a problem for every automaker in the world. It is a matter of public safety.” As Tesla, GM and many others continue to release connected vehicles, the dangers of cybersecurity are very real. In fact, more than half of the vehicles sold today are connected and vulnerable. This threat will only grow as manufacturers begin to release autonomous vehicles.

Cybersecurity in Connected Vehicles and Mobile Applications

While gaining access to, and being able to control or steal, a vehicle such as a Tesla is disturbing enough, it raises several concerns about not only cybersecurity in connected cars, but also the mobile applications that extend the features of these vehicles and others. In fact, mobile apps are quickly becoming the main target for malicious behavior. Over the last four years, there has been a 188 percent increase in the number of Android vulnerabilities and a 262 percent increase in the number of iOS vulnerabilities. In addition, according to Gartner, 75 percent of mobile apps would fail basic security tests.

Digging deeper, Veracode found that four out of five applications written in PHP, Classic ASP and ColdFusion failed at least one of the OWASP Top 10, implying that many web-based applications and websites contain security vulnerabilities. More than 80 percent of mobile apps on both the Android and iOS platform revealed cryptographic implementation issues. This attempt to protect and then doing it poorly highlights the importance of updated training and tools to aid these feature developers as they target secure and protected applications.

Recently, Android malware has become more stealth. Last year, in 2015, malware began to obfuscate code to bypass signature-based security software. Despite Google’s response to critical vulnerabilities and patches of critical issues in the Android OS, end users are still dependent on device manufacturers for these updates.

Tesla and other automobiles today can have the computing power of 20 personal computers and feature 100 million lines of programming code. While features such as web browsing, Wi-Fi access points and remote-start mobile phone apps, help to enhance the enjoyment of the vehicle, they also add more opportunities for advanced attacks. In real life, thieves are hacking keyless entry systems in the UK to steal cars, meanwhile, software recalls have doubled within the past year, and soon they will match mechanical recalls.

The mobile application industry is pushing forward a new level of interoperability that will require heightened security and privacy measures. App developers are in a position where they can reduce the number of vulnerabilities before the app ships. Auto manufacturers are also prioritizing cybersecurity in connected vehicles as a major safety feature to compete with features requiring connectivity.

This article originally appeared on Intertrust.com Intertrust.com 

Read more about how Intertrust’s suite of products helps automobile manufacturers address privacy and security in the age of the connected car. connected car.