![Your Smart TV Might Be Susceptible to Mind-Control [Encryption Digest 8] - cover graphic](/_next/image/?url=https%3A%2F%2Fcdn.venafi.com%2F994513b8-133f-0003-9fb3-9cbe4b61ffeb%2F4bc9aec2-2bc2-40c3-9d83-735eee866b14%2Faid_field_img__a0d84095a69916207eb7d03214ec827c.png%3Fw%3D864%26h%3D370%26fm%3Dwebp%26q%3D75%26fit%3Dcrop&w=3840&q=75&dpl=dpl_3EAuLccmwaq4KZ9GcZftJq5NbwLA){kind=small}
What happens in a world without encryption, and the proper ethics that go with it? This week we’ll investigate how fragile our system of trust is in a world where we protect against hacks, then hack to protect.
With the means at our disposal—and any lapse in principles—your television could be remote controlled by your neighbor’s drone, a simple pentest of your organization’s defenses could get ugly, and private transportation information from Brazil could end up on a malware site.
And, in an admittedly worst-case scenario, democracy could be challenged by any lapse in voting security. The importance of good encryption and the ethics to match, all in this week’s Encryption Digest.
"Many of our findings are uncomfortable” | When pentesting goes too far
What’s the difference between a pentest and a data compromise? Lately, those terms have not been mutually exclusive.
Just last week, Blackberry announced Brazil’s civilian air-traffic control details were found on a public malware repository. Their report, Thin Red Line – Penetration Testing Practices Examined, calls into question many practices common to pentesters, and scrutinizes many well-known companies seeking to plant their flag in the field.
Penetration testing, or ethical hacking, is a way of proving the secureness of various encrypted systems in the hopes of catching vulnerabilities before an attacker does. Nothing is off limits; cross-site scripting, hash cracking, busting down backdoors.
After reaching elbow-deep into the data, Kevin Livelli, Director of Threat Intelligence at BlackBerry® Cylance®, surfaces to report: “[M]any of our findings are uncomfortable.”
Related posts
- Why Governments Should Be Wary of Encryption Backdoors
- Hacking Requires Exceptional Skills: Can IT Security Pros Keep Up?
- Marriott Data Breach: 500 Million Reasons Why It’s Critical to Protect Machine Identities
Heads up: your smart TV might be susceptible to mind-control
We may have discovered the most convoluted way to share Netflix accounts.
Remember that remote insulin shot that remained unencrypted, leaving it open for hackers to swipe the radio frequency and inject shots of their own? Well, apparently, we’re still not doing enough to secure the airwaves. At Defcon last week, security researcher Pedro Cabrera noted the ease with which someone could override the television frequency of an unencrypted TV connection and broadcast their own channel instead.
Far from a chance at stardom, he predicts these will be used for social engineering attacks—say, the phishiness of a scam email meets an unassuming pay-per-view lookalike.
"No one expects to have this kind of social engineering attack on their smart TV," he says.
Well, not before now.
Like you were there: At Defcon, Cabrera demonstrated the attack by broadcasting a signal from a hovering drone equipped with a software-defined radio. But he adds, "If I want to target my neighbor, the easiest way is with an amplifier and a directional antenna...then for sure my signal will be received.” Good to know.
Related posts
- Lethal Apps, Contraband Huawei and a Door that Unlocks Itself
- Overheard at Black Hat: Things to Make it Seem Like You Were Really There
- Is the War on Encryption a Fight Between Privacy and Safety?
Sword in the stone: can you crack the $10M Darpa voting machine?
Best. Voting Machine. Ever.
Or so we hope. Darpa, the government’s crack squad of science tech [Defense Advanced Research Project Agency] poured $10 million dollars into developing an uncrackable voting machine. Did it work? Well, they unleashed the best of Defcon on it this past weekend to find out. At the Voting Village, scores of would-be-hackers took their best shot at breaching the impenetrable beast.
“All of this is here for people to poke at,” says principle researcher Dan Zimmerman of Galois, verifiable systems firm in charge of creation. “I don’t think anyone has found any bugs or issues yet, but we want people to find things.”
The encryption was strong with this one, as we have it on good information that no one was able to find anything - but the opportunities are still out there. Darpa’s voting machine will be taking a two-year university tour to discover the weak link that could bring it down.
Food for thought: There’s a sort of unspoken ethics in the hacking community, especially with community-good efforts like this one. We all want a safer voting machine...don’t we? Or does the public tour increase attack vectors by potentially trusting intimate voting machine knowledge to the wrong hands? Leave your thoughts in the comments below.
Related posts
- Electronic Voting and Election Fraud
- Voting Machine Hacks: Attacks on SSL and Certificate Trust May Break Elections
- Venafi Study: Election Infrastructure Is at Risk
“A business cannot stick their head in the sand” | CipherCloud founder tells encryption like it is
Last week Pravid Kothari, founder of CipherCloud, came out against corporate lethargy when it comes to secure data encryption.
“Companies will have to begin to weigh the risk and reward of doing the minimum and stepping up to a strong encryption and tokenization techniques... In these times, a business cannot stick their head in the sand and do nothing.”
If you haven’t secured your number one machine identity assets, you may want to do so now. Still on the fence? We’ll let Pravid preach.
Reasons to care about encrypting your cash cow:
- The average breach comes with a fee of 8% of your revenue. If you’re not Facebook or Equifax, you probably can’t survive that.
- If you send unencrypted data to cloud applications like Office 365, Salesforce, Dropbox, Slack, AWS and Azure, it will most likely remain that way – everywhere except their backend storage.
- If you store your private keys on the same server as the encrypted data, it’s like leaving the keys in the car.
And a data breach for your business in the future? Pravid says it’s “assumed”.
Related posts