Summary
FairPlay is an encryption scheme (DRM) developed by Apple to prevent users from further distributing playable content to other users. It has been cracked numerous times in different ways to create unrestricted/unencrypted versions of the content. The technology has since been renamed “Hymn”. Continue reading
No need to go to great lengths to try to spoof finger print scanners on USB sticks. You can just tell the device that the data is public. Researches discovered this vulnerability in models from 9pay and A-Data fingerprint USB data sticks. The vulnerability lies in a fundamental design flaw: the signal to access the data comes from the PC, and is not computed on board the chip. This means all one has to do is send the correct signal and the stick happily discloses the data. This can be done with a very simple command from an opensource utility. The manufacturers commented admitting they were aware of the vulnerability, but that it was difficult enough that most people wouldn’t figure it out. A fine example of attempted security through obscurity.
McAfee noticed Wednesday an ongoing attack that modifies web pages to redirect traffic to another site in China. This site then infects PC’s with a Trojan to steal personal information, including usernames/passwords for online banking. According to McAfee, “one gang” alone has infected about 12,000 sites, all over the globe. Apparently there may be different groups, because elsewhere in the article mention is made that hundreds of thousands of web pages have been compromised.
Summary
The Husky Card is a University of Washington student’s lifeline. It provides student identification, building access, public transportation, and access to monetary funds for use on and around campus.
Starting in 2009, the Husky Card will get an upgrade to smart card technology. This is in response to the local public transportation agencies’ ORCA (One Regional Card for All) project which implements an electronic fare system. Following implementation of this system, Regional Transit will no longer accept the current U-PASS stickers and will require smart cards. Continue reading
Within the last couple of years, Valve Corporation (of Half-Life fame) over in Bellevue designed and implemented a content distribution platform called “Steam” with the intent of distributing its games through a distributed network placed around the world. Their goal was three-fold: (1) make it simpler to roll out updates instead of forcing clients to manually download patches, (2) make a streamlined interface to purchase, configure, and use the games, and (3) cut out the middle-man (the publisher) and take the additional profit to implement Steam.
While the idea of software viruses is by no means new to those who work with computers, a new vector of attack seems to be developing in the form of hardware shipped from the manufacturer that is already infected with malware. In the past few weeks, a set of digital peripherals, particularly USB picture frames and IPods, have been found to contain one or more malicious executables. With such a method of delivery, it seems that the security industry may need to rethink what can and cannot be considered secure.
http://www.cnn.com/2008/TECH/ptech/03/13/factory.installed.virus.ap/index.html?iref=mpstoryview
The premise is, at some point in the future, it would be ideal for the internet to be using IPv6 as it’s main backbone, rather than the current IPv4. A discussion of the features and algorithms of IPv6 is beyond the scope of this review, but if you are unfamiliar with it, or have questions, wikipedia has some good information. The target of this review is that hypothetical night when ISPs, whether all at once or one-by-one, shut off access to the internet via IPv4.
iPhone offers lots of convenient functionality, such as phone, internet, music play and etc., making it a communication power house. However, it also opens up lots of new security risks. Since there is already an security review on iPhone 3rd party apps, I will focus on iPhone it self. Continue reading
I was recently informed about a rather interesting service that is being used in Kenya called M-PESA. According to their website, “M-PESA provides an affordable, fast, convenient and safe way to transfer money by SMS anywhere in Kenya. Through M-PESA you can:
At first glance, I thought that the original intent M-PESA was for buying and transferring airtime while financial transactions were just a side affect; however, according to the FAQ M-PESA is intended to be “an innovative mobile payment solution that enables customers to complete simple financial transactions including person to person money transfer. It is aimed at mobile customers who do not have a bank account, either through choice, because they do not have access to a bank or because they do not have sufficient income to justify a bank account.” Continue reading
It was recently announced that last February at least one hacker was able to gain access on one server at Harvard University potentially viewing private information on up to 10,000 grad students and applicants of the Graduate School of Arts and Sciences.
